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Abstract 

Controlling operational errors and decoherence is one of the major challenges 
facing the field of quantum computation and other attempts to create specified 
many-particle entangled states. The field of quantum error correction has de- 
veloped to meet this challenge. A group-theoretical structure and associated 
subclass of quantum codes, the stabilizer codes, has proved particularly fruitful 
in producing codes and in understanding the structure of both specific codes and 
classes of codes. I will give an overview of the field of quantum error correction 
and the formalism of stabilizer codes. In the context of stabilizer codes, I will 
discuss a number of known codes, the capacity of a quantum channel, bounds 
on quantum codes, and fault-tolerant quantum computation. 
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Chapter 1 

Introduction and 
Preliminary Material 

1.1 Quantum Computers 

Computers have changed the world in many ways. They are ubiquitous, run- 
ning air-traffic control and manufacturing plants, providing movie special effects 
and video games, and serving as a substrate for electronic mail and the World 
Wide Web. While computers allow us to solve many problems that were simply 
impossible before their advent, a number of problems require too much com- 
putation to be practical even for relatively simple inputs, and using the most 
powerful computers. 

The field of classical complexity theory has developed to classify problems by 
their difficulty. A class of problems is generally considered tractable if an algo- 
rithm exists to solve it with resources (such as time and memory) polynomial in 
the size of the input. Two well-known classically intractable problems are factor- 
ing an n-bit number and the Traveling Salesman problem (finding the minimum 
cyclic path connecting n cities with specified distances between them) . Both of 
these problems are in the complexity class NP (for "non-deterministic polyno- 
mial")]] given a black box that solves the problem (an oracle) , we can check in 
polynomial time that the solution is correct. The Traveling Salesman problem 
is an NP-completc problem; that is, any problem in NP can be transformed into 
an instance of the Traveling Salesman problem in polynomial time. If we can 
solve the Traveling Salesman problem in polynomial time, we can solve any NP 
problem in polynomial time. Factoring may or may not be NP-complete, but 
so much work has been done attempting to solve it that the consensus is that it 
is classically intractable, and RSA public-key cryptography, which is used, for 
instance, to send credit-card numbers in Web browsing software, depends on 
the difficulty of factoring large numbers. 

1 Strictly speaking, it is the associated decision problems that are in NP. 
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As computer hardware develops over time, the underlying technology con- 
tinually changes to become faster, smaller, and generally better. What was 
impossible on yesterday's computers may be quite possible today. A problem 
that was intractable on the earlier hardware might become tractable with the 
new technology. However, the strong Church- Turing Thesis |l[ states that this 
is not the case, and that every physical implementation of universal computa- 
tion can simulate any other implementation with only a polynomial slowdown.^ 
In this way, the Church- Turing Thesis protects complexity theory from obsoles- 
cence as computer technology improves. While a new computer may be able to 
factor larger numbers, the difficulty of factoring numbers will still scale the same 
way with the size of the input on the new hardware as on the old hardware. 

Another problem that has proven to be classically intractable is simulating 
quantum systems. A single spin-1/2 particle, such as an electron trapped in 
a quantum dot, has a two-dimensional space of states, which can be consid- 
ered to describe the direction of its spin. A similar classical particle such as a 
Heisenberg spin would also have a two-dimensional space of states. However, n 
quantum particles have a 2™-dimensional state space, while n classical Heisen- 
berg spins would only have a 2n-dimensional space of states. The extra states in 
the quantum system come from the presence of entangled states between many 
different particles. Note that while an n-bit classical digital computer has 2™ 
possible states, they only form an n-dimensional state space, since a state can 
be described by an n-component binary vector. To describe a state in a quan- 
tum computer with n qubits requires a complex vector with 2" components. 



I give a basic introduction to quantum mechanics in section 1.2. Quantum 



systems are difficult to simulate classically because they generically utilize the 
full 2™-dimensional Hilbert space as they evolve, requiring exponential classical 
resources. 

This fact led Feynman to conjecture that a quantum computer which used 
quantum mechanics intrinsically might be more powerful than a computer mired 
in the classical world While this seems a sensible suggestion when just look- 
ing at quantum mechanics, it is in fact quite revolutionary in that it suggests 
that the strong Church- Turing Thesis is wrong !0 This opens up the possibility 
that classical complexity classes might not apply for quantum computers, and 
that some classically intractable problems might become tractable. The most 
spectacular instance of this is Shor's discovery of an algorithm to factor num- 
bers on a quantum computer in a polynomial time in the number of digits ||. 
Another impressive algorithm is Grover's algorithm 0], which can find a single 
object in an unsorted database of N objects in 0(y/~N) time on a quantum 
computer, while the same task would require an exhaustive search on a classi- 
cal computer, taking O(N) time. It has been shown that 0(y/~N) time is the 
best possible speed for this task B, which tends to suggest that NP-complete 
problems are still intractable on a quantum computer, although this has not 

2 The original Church- Turing thesis only states that any universal computer can simulate 
any other computer, but the requirement of polynomial resources is a useful strengthening. 

3 A classical computer can simulate a quantum computer, but only with exponential re- 
sources, so the weak Church- Turing Thesis does still hold. 
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been shown (note that a proof of this would also show P ^ NP for a classical 
computer). 

However, declaring by theoretical fiat the basic properties of a quantum 
computer is a far cry from actually building one and using it to factor large 
numbers. Nevertheless, the first steps in building a quantum computer have 
been taken. Any quantum computer requires a system with long-lived quantum 
states and a way to interact them. Typically, we consider systems comprised of 
a number of two-state subsystems, which are called qubits (for "quantum bits"). 
There are many proposals for how to build a quantum computer. Some possible 
physical realizations of qubits are: 

• the ground and excited states of ions stored in a linear ion trap, with 
interactions between ions provided through a joint vibrational mode |g[ [7J. 

• photons in either polarization, with interactions via cavity QED 

• nuclear spin states in polymers, with interactions provided by nuclear 
magnetic resonance techniques ||. 

While these implementations are seemingly very different, it is possible to sim- 
ulate the computational process of one system on any of the others, providing 
a quantum analogue to the Church- Turing Thesis (although there are difficult 
technical or theoretical problems with scaling up the size of these implementa- 
tions). 

These suggested implementations of quantum computers all share a much 
higher susceptibility to errors than modern classical computers. While further 
development may reduce the size of errors by orders of magnitude, it is unlikely 
that quantum computers will ever reach the incredible reliability of classical 
computers. Modern classical computers guard against error largely by being 
digital instead of analog — instead of allowing each bit of the computer to vary 
continuously between and 1, at each time step the hardware kicks the bit 
back to the nearer of and 1. This prevents small errors from building up 
into large errors, which are therefore drastically reduced. The same technique 
cannot be used in a quantum computer, because continually measuring each 
qubit would destroy the entangled states that distinguish a quantum computer 
from a classical computer. 

Entangled states are in general very delicate, and making a measurement 
on one will typically collapse it into a less entangled state. Small interactions 
with the environment provide a sort of continuous measurement of a system, 
and as the system grows in size, these become harder and harder to ignore. 
The system will decohere and begin to look like a classical system. Decoherence 
is why the world looks classical at a human scale. Reducing interactions with 
the environment can reduce the effects of decoherence, but not eliminate them 
entirely. 

Even if the basal error rate in a quantum computer can be reduced to some 
small value e per unit time, after N time steps, the probability of surviving 
without an error is only (1 — e) N , which decreases exponentially with N. Even 



CHAPTER 1. INTRODUCTION AND PRELIMINARY MATERIAL 4 



if an algorithm runs in polynomial time on an error-free computer, it will require 
exponentially many runs on a real computer unless something can be done to 
control the errors. 

The same problem occurs for classical computers. There, the problem can 
be solved in principle by the use of error-correcting codes. In practice, they are 
not usually necessary for normal computer operation, but they are essential to 
overcome noise in communications channels. I giv e a b asic introduction to the 
theory of classical error-correcting codes in section 1.3 . 

Classical error-correction techniques cannot be directly carried over to quan- 
tum computers for two reasons. First of all, the classical techniques assume we 
can measure all of the bits in the computer. For a quantum computer, this 
would destroy any entanglement between qubits. More importantly, a classical 
computer only needs to preserve the bit values of and 1. A quantum computer 
also needs to keep phase information in entangled states. Thus, while quantum 
error-correcting codes are related to classical codes, they require a somewhat 
new approach. 

The first quantum error-correcting codes were discovered by Shor fllPf and 
Steane JO). I discuss Shor's original code and some basics of quantum error- 
correcting codes in chapter ^. I then go on to describe the formalism of stabilizer 
codes in chapter ^, along with some simple examples and methods for creating 
new codes from old ones. Chapter ||| describes how to build networks to encode 
and decode stabilizer codes. Because we will want to use these codes in the 
operation of quantum computers, in chapter ||, I will discuss how to perform 
operations on states encoded using a quantum error-correcting code without 
losing the protection against errors. Chapter || describes how to use concate- 
nated codes to do arbitrarily long calculations as long as the basic error rate is 
below some threshhold value, and presents a rough calculation of that thresh- 
hold. Chapter ^ discusses known upper and lower bounds on the existence of 
stabilizer codes and the channel capacity. Finally, in chapter |8| I will give a 
partial list of known quantum error-correcting codes and their properties. Ap- 
pendix |a| contains a brief discussion of quantum gates and a list of symbols 
for them used in figures. Appendix contains a glossary of useful terms for 
discussing quantum error-correcting codes. 

Since the promise of quantum computation has attracted scientists from a 
number of fields, including computer science, mathematics, and physics, some 
of the background one group takes for granted may be alien to others. There- 
fore, in the following two sections, I have provided basic introductions to quan- 
tum mechanics and classical coding theory. People familiar with one or both 
fields should skip the appropriate section(s). For a more complete treatment 
of quantum mechanics, se e |T^ ]. For a more complete treatment of classical 
error-correcting codes, see |l3fl. 
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1.2 Introduction to Quantum Mechanics 

The state of a classical computer is a string of Os and Is, which is a vector over 
the finite field Z2. The state of a quantum computer (or any quantum system) 
is instead a vector over the complex numbers C. Actually, a quantum state lies 
in a Hilbert space, since there is an inner product (which I will define later). 
The state is usually written which is called a ket. A classical computer with 
n bits has 2" possible states, but this is only an rt-dimensional vector space over 
Z2 . A quantum computer with n qubits is a state in a 2™-dimensional complex 
vector space. For a single qubit, the standard basis vectors are written as |0) 
and |1). An arbitrary single-qubit state is then 

a\0)+P\l). (1.1) 

a and (3 are complex numbers, with \a\ 2 + \(3\ 2 = 1. This is a normalized state. 
With multiple qubits, we can have states that cannot be written as the product 
of single-qubit states. For instance, 

^=(|00) + |11)) (1.2) 

cannot be decomposed in this way. Such a state is said to be entangled. En- 
tangled states are what provide a quantum computer with its power. They will 



also play a major role in quantum error correction. The particular state (1.2) 
is called an Einstein-Podalsky-Rosen pair (or EPR) pair, and serves as a useful 
basic unit of entanglement in many applications. 

If we make a measurement on the qubit in equation ( |l.l| ), we get a classical 
number corresponding to one of the basis states. The measurement disturbs 
the original state, which collapses into the basis state corresponding to the 



measurement outcome. If we measure the state (1.1), the outcome will be 
with probability \a\ 2 , and it will be 1 with probability |/?| 2 . The normalization 
ensures that the probability of getting some result is exactly 1. Through most 
of this thesis, I will instead write down unnormalized states. These states will 
stand for the corresponding normalized states, which are formed by multiplying 
the unnormalized states by an appropriate constant. The overall phase of a 
state vector has no physical significance. 

The measurement we made implements one of two projection operators, the 
projections on the basis |0), |1). This is not the only measurement we can make 
on a single qubit. In fact, we can project on any basis for the Hilbert space 
of the qubit. If we have multiple qubits, we can measure a number of different 
qubits independently, or we can measure some joint property of the qubits, which 
corresponds to projecting on some entangled basis of the system. Note that the 
projection on the basis |0), |1) for either qubit destroys the entanglement of the 



state (F2), leaving it in a tensor product state. 

A particularly fruitful way to understand a quantum system is to look at the 
behavior of various operators acting on the states of the system. For instance, 
a nice set of operators to consider for a single qubit is the set of Pauli spin 
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matrices 



1\ / -i\ , MO 



1 ) ' v \ i 



and a z = I Q _ 1 1 . (1.3) 



The original measurement I described corresponds to measuring the eigenvalue 
of a z . The corresponding projection operators are \{I ±cr z ). If we have a spin- 
1 /2 particle, this measurement is performed by measuring the spin of the particle 
along the z axis. We could also measure along the x or y axis, which corresponds 
to measuring the eigenvalue of a x or <r y . The projections are \(I ± a x ) and 

\{l±Oy). 

We can also make measurements of more general operators, provided they 
have real eigenvalues. A matrix A has real eigenvalues iff it is Hermitian: A^ = 
A, where A^ is the Hermitian adjoint (or just adjoint), equal to the complex 
conjugate transpose. Note that all of the Pauli spin matrices are Hermitian. 

The Pauli matrices also satisfy an important algebraic property — they 
anticommute with each other. That is, 

{<Ji,o-j} = o-iO-j + o-jO-i = (1.4) 

whenever i ^ j (with i,j e {x,y,z}). Another possible relationship between 
two operators A and B is for them to commute. That is, 

[A, B] = AB - BA = 0. (1.5) 

It is possible for two matrices to neither commute nor anticommute, and, in 
fact, this is the generic case. Two commuting matrices can be simultaneously 
diagonalized. This means that we can measure the eigenvalue of one of them 
without disturbing the eigenvectors of the other. Conversely, if two operators 
do not commute, measuring one will disturb the eigenvectors of the other, so 
we cannot simultaneously measure non-commuting operators. 

There is a natural complex inner product on quantum states. Given an 
orthonormal basis \ipi), the inner product between \a) = ^Ci|V>i) and |/3) = 

H/?> = £ c*d 3 (^ 3 ) = ]T c*di. (1.6) 

Each ket corresponds to a bra (tp\ and the Hermitian adjoint is the adjoint 
with respect to this inner product, so U\tjj) corresponds to . The operator 

IV'X'^I ac ts on the Hilbert space as follows: 

(X>>w)i«> = EM a > iv>>. (i.7) 

The inner product can reveal a great deal of information about the structure of 
a set of states. For instance, (tp\(f>) = 1 if and only if jV) = \4 > )- 

Eigenvectors of a Hermitian operator A with different eigenvalues are auto- 
matically orthogonal: 

W\A\<I>) = (1>\(A\<t>)) =\ 4> {m (1-8) 
= «V>|.4)|0>=A;<V#>. (1.9) 
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Since the eigenvalues of A are real, it follows that (ip\<fr) — whenever ^ X^. 
Conversely, if (ij)\<f>) — 0, there exists a Hermitian operator for which and 
|0) are eigenvectors with different eigenvalues. 

We often want to consider a subsystem A of a quantum system B. Since 
A may be entangled with the rest of the system, it is not meaningful to speak 
of the "state" of A. If we write the state of B as |V^)|0i), where is an 
orthonormal basis for B — A, and \<pi) are possible states for A, then to an 
observer who only interacts with the subsystem *4, the subsystem appears to be 
in just one of the states \<pi) with some probability. A is said to be in a mixed 
state as opposed to the pure state of a closed system in a definite state. 

We can extend the formalism to cover mixed states by introducing the density 
matrix p. For a pure system in the state \ip), the density matrix is \tp)(ip\. The 
density matrix for the subsystem for the entangled state above is Yl I0i)(0i|- 
Density matrices are always positive and have tr p = 1. To find the density 
matrix of a subsystem given the density matrix of the full system, simply trace 
over the degrees of freedom of the rest of the system. 

Given a closed quantum system, time evolution preserves the inner product, 
so the time evolution operator U must be unitary. That is, U^U — UU^ = I. 
An open system can be described as a subsystem of a larger closed system, so 
the evolution of the open system descends from the global evolution of the full 
system. Time evolution of the subsystem is described by some superoperator 
acting on the density matrix of the subsystem. 

One fact about quantum states that has profound implications for quantum 
computation is that it is impossible to make a copy of an arbitrary unknown 
quantum state. This is known as the "No Cloning Theorem," |Q and is a con- 
sequence of the linearity of quantum mechanics. The proof is straightforward: 
Suppose we wish to have an operation that maps an arbitrary state 

M -> M ® IV>- (i.io) 

Then arbitrary |0) is mapped by 

10) ^10)® 10) (i-ii) 

as well. Because the transformation must be linear, it follows that 

m + \4>) -► m ® w + 10) ® 10). (i.i2) 

However, 

iv) ® m + k) ® 10) ^ qv>) + 10)) ® (w + 10)), (i.i3) 

so we have failed to copy \t(}) + |0). In general, if we pick an orthonormal basis, 
we can copy the basis states, but we will not have correctly copied superpositions 
of those basis states. We will instead have either measured the original system 
and therefore destroyed the superposition, or we will have produced a state 
that is entangled between the original and the "copy." This means that to 
perform quantum error correction, we cannot simply make backup copies of the 
quantum state to be preserved. Instead, we must protect the original from any 
likely error. 
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1.3 Introduction to Classical Coding Theory 

Classical coding theory tends to concentrate on linear codes, a subclass of all 
possible codes with a particular relation between codewords. Suppose we wish 
to encode k bits using n bits. The data can be represented as a /c-dimensional 
binary vector v. Because we are dealing with binary vectors, all the arithmetic 
is mod two. For a linear code, the encoded data is then Gv for some n x k matrix 
G (with entries from Z2), which is independent of v. G is called the generator 
matrix for the code. Its columns form a basis for the /c-dimensional coding sub- 
space of the n-dimensional binary vector space, and represent basis codewords. 
The most general possible codeword is an arbitrary linear combination of the 
basis codewords; thus the name "linear code." 

Given a generator matrix G, we can calculate the dual matrix P, which is 
an (n — k) x n matrix of Os and Is of maximal rank n — k with PG — 0. Since 
any codeword s has the form Gv, Ps — PGv = Ov = 0, and P annihilates 
any codeword. Conversely, suppose Ps — 0. Since P has rank n — k, it only 
annihilates a fc-dimensional space spanned by the columns of G, and s must be 
a linear combination of these columns. Thus, s = Gv for some v, and s is a 
valid codeword. The matrix P is called the parity check matrix for the code. It 
can be used to test if a given vector is a valid codeword, since Ps — iff s is 
a codeword. The dual code is defined to be the code with generator matrix P T 
and parity matrix G T . 

In order to consider the error-correcting properties of a code, it is useful 
to look at the Hamming distance between codewords. The Hamming distance 
between two vectors is the minimum number of bits that must be flipped to 
convert one vector to the other. The distance between a and b is equal to the 
weight (the number of Is in the vector) of a + b. For a code to correct t single- bit 
errors, it must have distance at least 2t + 1 between any two codewords. A t 
bit error will take a codeword exactly distance t away from its original value, so 
when the distance between codewords is at least 2t + 1, we can distinguish errors 
on different codewords and correct them to the proper codewords. A code to 
encode k bits in n bits with minimum distance d is said to be an [n, k, d] code. 

Now suppose we consider a t bit error. We can write down a vector e to 
describe this vector by putting ones in the places where bits are flipped and zeros 
elsewhere. Then if the original codeword is s, after the error it is s' = s + e. If 
we apply the parity check matrix, we get 

Ps' = P(s + e) = Ps + Pe = + Pe = Pe, (1.14) 

so the value of Ps' does not depend on the value of s, only on e. If Pe is 
different for all possible errors e, we will be able to determine precisely what 
error occurred and fix it. Pe is called the error syndrome, since it tells us what 
the error is. Since Pe = Pf iff P(e — f) = 0, to have a code of distance d, we 
need Pe 7^ for all vectors e of weight d — 1 or less. Equivalcntly, any d — 1 
columns of P must be linearly independent. 

We can place upper and lower bounds on the existence of linear codes to 
correct t errors. Each of the 2 k codewords has a Hamming sphere of radius t. 
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All the words inside the Hamming sphere come from errors acting on the same 
codeword. For a code on n bits, there are n one-bit errors, (™) two-bit errors, 
and in general (") J-bit errors. The Hamming spheres cannot overlap, but they 
must all fit inside the vector space, which only has 2™ elements. Thus, 



This is called the Hamming bound on [n,k,2t + 1] codes. As n, k, and t get 
large, this bound approaches the asymptotic form 

k <i-n(L), (Lie) 



n \n 



where H(x) is the Hamming entropy 

H{x) = -xlog 2 x-{l-x) log 2 (l - x). (1.17) 

We can set a lower bound on the existence of [n, k, 2t + l] linear codes as well, 
called the Gilbert- Varshamov bound. Suppose we have such a code (if necessary 
with k = 0) with 



it 

7 ; 



3=0 



Then the spheres of distance 2t around each codeword do not fill the space, so 
there is some vector v that is at least distance 2t + 1 from each of the other 
codewords. In addition, v + s (for any codeword s) is at least distance 2t + 1 
from any other codeword s' , since the distance is just (v + s) + s' — v + (s + s'), 
which is the distance between v and the codeword s + s'. This means that we 
can add v and all the vectors v + s to the code without dropping the distance 
below 2t + 1. This gives us an [n, A; + 1,24+ 1] code. We can continue this 
process until 

fV^W^". (1.19) 



Asymptotically, this becomes 



k (2t\ 

> 1 - H — . (1.20) 



n \ n 



Another case of great interest is the capacity of a classical channel. This is 
equal to the efficiency k/n of the most efficient code on an asymptotically large 
block that corrects measure one of the errors occuring. For instance, a common 
channel is the binary symmetric channel, where an error occurs independently 
on each bit with probability p for both and 1. Shannon showed that channel 
capacity is just equal to one minus the entropy introduced by the channel [ |i5| |. 
For the binary symmetric channel, the entropy is just the Hamming entropy 
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H(p), so the capacity is 1 — H(p), coinciding with the Hamming bound for the 
expected number of errors t = pn. Shannon also showed that the capacity of 
a channel can be achieved by choosing codewords at random, then discarding 
only a few of them (measure zero asymptotically) . 
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Chapter 2 

Basics of Quantum Error 
Correction 

2.1 The Quantum Channel 

Now we turn to the quantum channel. A noisy quantum channel can be a regular 
communications channel which we expect to preserve at least some degree of 
quantum coherence, or it can be the passage of time as a set of qubits sits 
around, interacting with its environment, or it can be the result of operating 
with a noisy gate on some qubits in a quantum computer. In any of these cases, 
the input of a pure quantum state can produce a mixed state as output as the 
data qubits become entangled with the environment. Even when a pure state 
comes out, it might not be the same state as the one that went in. 

At first it appears that trying to correct a mixed state back into the correct 
pure state is going to be harder than correcting an erroneous pure state, but 
this is not the case. The output mixed state can be considered as an ensemble 
of pure states. If we can correct each of the pure states in the ensemble back to 
the original input state, we have corrected the full mixed state. Another way of 
phrasing this is to say the channel applies a superoperator to the input density 
matrix. We can diagonalize this superoperator and write it as the direct sum of 
a number of different matrices acting directly on the possible input pure states 
with various probabilities. If the code can correct any of the possible matrices, 
it can correct the full superoperator. A key point is that the individual matrices 
need not be unitary. From now on, I will only consider the effects of a (possibly 
non-unitary) matrix acting on a pure state. 

2.2 A Simple Code 

For the moment, let us consider only channels which cause an error on a single 
qubit at a time. We wish to protect a single logical qubit against error. We 
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cannot send it through the channel as is, because the one qubit that is affected 
might be the one we want to keep. Suppose we send through nine qubits after 
encoding the logical qubit as follows: 

|0> -> |0) = (|000) + |111))(|000) + |111))(|000) + |111)) (2.1) 
|1} - |T) = (|000> -|111))(|000)-|111))(|000)- |111)). (2.2) 

The data is no longer stored in a single qubit, but instead spread out among 
nine of them. Note that even if we know the nine qubits are in one of these two 
states, we cannot determine which one without making a measurement on at 
least three qubits. This code is due to Shor (hJ. 

Suppose the channel flips a single qubit, say the first one, switching |0) and 
|1). Then by comparing the first two qubits, we find they are different, which 
is not allowed for any valid codeword. Therefore we know an error occurred, 
and furthermore, it flipped either the first or second qubit. Note that we do 
not actually measure the first and second qubits, since this would destroy the 
superposition in the codeword; we just measure the difference between them. 

Now we compare the first and third qubits. Since the first qubit was flipped, 
it will disagree with the third; if the second qubit had been flipped, the first and 
third would have agreed. Therefore, we have narrowed down the error to the 
first qubit and we can fix it simply by flipping it back. To handle possible bit 
flips on the other blocks of three, we do the same comparisons inside the other 
blocks. 

However, this is not the only sort of error that could have occurred. The 
channel might have left the identity of the and 1 alone, but altered their 
relative phase, introducing, for instance, a relative factor of —1 when the first 
qubit is |1). Then the two basis states become 

|0) _> (|000) - |111))(|000) + |111»(|Q00) + (2.3) 
|1) -> (|000) + |111))(|000)-|111))(|000)-|111)). (2.4) 

By comparing the sign of the first block of three with the second block of three, 
we can see that a sign error has occurred in one of those blocks. Then by 
comparing the signs of the first and third blocks of three, we narrow the sign 
error down to the first block, and flip the sign back to what it should be. Again, 
we do not want to actually measure the signs, only whether they agree. In this 
case, measuring the signs would give us information about whether the state is 
|0) or |1), which would destroy any superposition between them. 

This does not exhaust the list of possible one qubit errors. For instance, we 
could have both a bit flip and a sign flip on the same qubit. However, by going 
through both processes described above, we will fix first the bit flip, then the 
sign flip (in fact, this code will correct a bit flip and a sign flip even if they are 
on different qubits). The original two errors can be described as the operation 
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The simultaneous bit and sign flip is 

Oy = iOx<Jz = Q^j ■ (2.6) 

Sometimes I will write a X i, a y i, or a Z i to represent a x , a y , or a z acting on the 
ith qubit. 

The most general one-qubit error that can occur is some 2x2 matrix; but 
such a matrix can always be written as the (complex) linear combination of a x , 
<r y , <r z , and the 2x2 identity matrix /. Consider what happens to the code 
when such an error occurs: 

|V) - a\0) + (3\T) -» a<T xi |V) + ba yi \^) + ca zi \f) + d\if>). (2.7) 

Suppose we perform the process above, comparing bits within a block of three, 
and comparing the signs of blocks of three. This acts as a measurement of which 
error (or the identity) has occurred, causing the state, originally in a superposi- 
tion, to collapse to o~ X i\ip) with probability |a| 2 , to cr y i\ip) with probability \b\ 2 , 
to o zi \i\)) with probability |c| 2 , and to \i[>) with probability \d\ 2 . In any of the 
four cases, we have determined which error occurred and we can fix it. 



2.3 Properties of Any Quantum Code 

Now let us consider properties of more general codes. A code to encode k 
qubits in n qubits will have 2 k basis codewords corresponding to the basis of 
the original states. Any linear combination of these basis codewords is also a 
valid codeword, corresponding to the same linear combination of the unencoded 
basis states. The space T of valid codewords (the coding space) is therefore 
a Hilbert space in its own right, a subspace of the full 2™-dimensional Hilbert 
space. As with Shor's nine-qubit code, if we can correct errors E and F, we can 
correct aE + bF, so we only need to consider whether the code can correct a 
basis of errors. One convenient basis to use is the set of tensor products of a x , 
<r y , <r z , and I. The weight of an operator of this form is the number of qubits 
on which it differs from the identity. The set of all these tensor products with a 
possible overall factor of — 1 or ±i forms a group Q under multiplication. Q will 
play a major role in the stabilizer formalism. Sometimes I will write it Q n to 
distinguish the groups for different numbers of qubits. Q\ is just the quaternionic 
group; Q n is the direct product of n copies of the quaternions modulo all but a 
global phase factor. 

In order for the code to correct two errors E a and E^, we must always be 
able to distinguish error E a acting on one basis codeword \ipi) from error Eb 
acting on a different basis codeword \ipj). We can only be sure of doing this 
if E a \tl>i) is orthogonal to Eb\ip2)', otherwise there is some chance of confusing 
them. Thus, 

(iPMWj) = (2-8) 
when i ^ j for correctable errors E a and E^- Note that we normally include the 
identity in the set of possible "errors," since we do not want to confuse an error 
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on one qubit with nothing happening to another. If we have a channel in which 
we are certain some error occurred, we do not need to include the identity as a 
possible error. In any case, the set of correctable errors is unlikely to be a group 
— it does not even need to be closed under multiplication. 

However, fl2.8| ) is insufficient to guarantee a code will work as a quantum 
error-correcting code. When we make a measurement to hnd out about the 
error, we must learn nothing about the actual state of the code within the 
coding space. If we did learn something, we would be disturbing superpositions 
of the basis states, so while we might correct the basis states, we would not be 
correcting an arbitrary valid codeword. We learn information about the error 
by measuring (ipi\ElE b \ipi) for all possible errors E a and E b . This quantity 
must therefore be the same for all the basis codewords: 

(A\ElE b \A) = {^\ElE b \^). (2.9) 

We can combine equations ( (2.8[ ) and ( |2.9[ ) into a single equation: 

{i> i \ElE b \^ j ) = C ab S i j, (2.10) 

where \ipi) and \ipj) run over all possible basis codewords, E a and E b run over 
all possible errors, and C ab is independent of i and j. This condition was found 



by Knill and Lafiamme pa and Bennett et al. |17 



The above argument shows that (2.1C) is a necessary condition for the code 



to correct the errors {E a }. It is also a sufficient condition: The matrix C ab is 
Hermitian, so it can be diagonalized. If we do this and rescale the errors {E a } 
appropriately, we get a new basis {F a } for the space of possible errors, with 
either 

(2.11) 

or 

(A\FlF b \^) = 0, (2.12) 

depending on a. Note that this basis will not necessarily contain operators that 
are tensor products of one-qubit operators. Errors of the second type actually 
annihilate any codeword, so the probability of one occuring is strictly zero and 
we need not consider them. The other errors always produce orthogonal states, 
so we can make some measurement that will tell us exactly which error occurred, 
at which point it is a simple matter to correct it. Therefore, a code satisfies 
equation ( [2.10 ) for all E a and E b in some set £ iff the code can correct all errors 



in £. 

Another minor basis change allows us to find a basis where any two errors 
acting on a given codeword either produce orthogonal states or exactly the same 
state. The errors F a that annihilate codewords correspond to two errors that 
act the same way on codewords. For instance, in Shor's nine-qubit code, a z ± 
and o~ Z 2 act the same way on the code, so a z \ ~ er 2 2 will annihilate codewords. 
This phenomenon will occur iff C ab does not have maximum rank. A code for 
which C ab is singular is called a degenerate code, while a code for which it is 
not is nondegenerate. Shor's nine-qubit code is degenerate; we will see many 
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examples of nondegenerate codes later. Note that whether a code is degenerate 
or not depends on the set of errors it is intended to correct. For instance, a 
two-error-correcting degenerate code might be nondegenerate when considered 
as a one-error-correcting code. 

In equation ( 2. 1C ) , E = E\E^ is still in the group Q when E a and Ef, are in 
Q. The weight of the smallest E in Q for which (2.10) does not hold is called 
the distance of the code. A quantum code to correct up to t errors must have 
distance at least 2t + 1. Every code has distance at least one. A distance d 
code encoding k qubits in n qubits is described as an [n, k, d] code. Note that a 
quantum [n, k, d] code is often written in the literature as [[n, k, d]} to distinguish 
it from a classical [n, k, d] code. I have chosen the notation [n, k, d] to emphasize 
the similarities with the classical theory; when I need to distinguish, I will do 
so using the words "quantum" and "classical." 

We can also consider variations of the usual error-correction problem. For 
instance, suppose we only want to detect if an error has occurred, not to correct 
it. This could, for instance, be used to prevent errors using the quantum Zeno 
effect In this case, we do not need to distinguish error E a from Ef,, only 
from the identity. We can use the same argument to find (2.10), only now Eb = I 
always. This means a code to detect s errors must have distance at least s + 1. 
Another variation is when we know in which qubit(s) an error has occurred, as 
in the quantum erasure channel In this case, we only need distinguish E a 
from those Ej, affecting the same qubits. This means that E\E^ has the same 
weight as E a , and to correct r such located errors, we need a code of distance at 
least r + 1. We can also imagine combining all of these tasks. A code to correct 
t arbitrary errors, r additional located errors, and detect a further s errors must 
have distance at least r + s + 2t + 1 . 



2.4 Error Models 

In this thesis, I will mostly assume that errors occur independently on different 
qubits, and that when an error occurs on a qubit, it is equally likely to be a 
a x , (T y , or a z error. If the probability e of error per qubit is fairly small, it is 
often useful to simply ignore the possibility of more than t errors, since this 
only occurs with probability 0(e t+1 ). Thus, I will typically deal with codes 
that correct up to t arbitrary errors. Such a code will handle any error on up 
to t qubits that leaves the data somewhere in the normal computational space 
(although moving it outside of the space of valid codewords). 

In some systems, there will be errors that move the system outside of the 
computational space. For instance, if the data is stored as the ground or 
metastable excited state of an ion, the electron might instead end up in a differ- 
ent excited state. If the data is stored in the polarization of a photon, the photon 
might escape. In both of these cases, the normal error correction networks will 
not function properly, since they assume that the qubit is either in the state |0) 
or |1). However, by performing some measurement that distinguishes between 
the computational Hilbert space and other possible states, we can determine 
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Figure 2.1: Network to detect leakage errors. 



not only that this sort of leakage error has occurred, but also on which qubit 
it has occurred. Then we can cool the atom to the ground state or introduce a 
new photon with random polarization, and the error becomes a located error, 
which was discussed at the end of the previous section. One possible network 
of gates to detect a leakage error is given in figure 2A (see appendix |X| for a de- 



scription of the symbols used in this and later figures). This network asssumes 
that states outside the normal computational space do not interact at all with 
other qubits. If the data state is either |0) or |1), the ancilla qubit will flip 
and become |1). If the data state is neither |0) nor |1), the ancilla will remain 
|0), thus signalling a leakage error on this data qubit. 

Another possible difficulty arises when correlated errors on multiple qubits 
can occur. While this can in principle be a severe problem, it can be handled 
without a change in formalism as long as the chance of a correlated error drops 
rapidly enough with the size of the blocks of errors. Since a i-qubit error will 
occur with probability 0(e*) when the probability of uncorrelated single-qubit 
errors is e, as long as the probability of a i-qubit correlated error is O(e'), the 
correlated errors cause no additional problems. 

In real systems, the assumption that errors are equally likely to be o~ x , o~ y , 
and o~ z errors is a poor one. In practice, some linear combinations of o~ x , o~ y , 
and a z are going to be more likely than others. For instance, when the qubits 
are ground or excited states of an ion, a likely source of errors is spontaneous 
emission. After some amount of time, the excited state will either decay to the 
ground state, producing the error o~ x +io~ y with probability e, or it will not, which 
changes the relative amplitudes of |0) and |1), resulting in the error I — <r z with 
probability 0(e 2 ). A channel that performs this sort of time evolution is known 
as an amplitude damping channel. Since the only O(l) effect of time evolution 
is the identity, this sort of error can be protected against to lowest order by a 
code to correct an arbitrary single error. However, codes that take account of 
the restricted possibilities for errors can be more efficient than codes that must 
correct a general error [ p0| , and understanding the physically likely sources of 
error will certainly be an important part of engineering quantum computers. 
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Chapter 3 

Stabilizer Coding 



3.1 The Nine-Qubit Code Revisited 

Let us look more closely at the procedure we used to correct errors for the 
nine-qubit code. To detect a bit flip error on one of the first three qubits, we 
compared the first two qubits and the first and third qubits. This is equivalent 
to measuring the eigenvalues of o z \o z i and o z io z3 . If the first two qubits are 
the same, the eigenvalue of <j z \<j Z 2 is +1; if they are different, the eigenvalue 
is —1. Similarly, to detect a sign error, we compare the signs of the first and 
second blocks of three and the first and third blocks of three. This is equivalent 
to measuring the eigenvalues of a xl a x2 a x3 a x4 a x5 a x6 and a xl a x2 cr x3 a x7 a x8 a xg . 
Again, if the signs agree, the eigenvalues will be +1; if they disagree, the eigen- 
values will be —1. In order to totally correct the code, we must measure the 



eigenvalues of a total of eight operators. They are listed in table |3.1 . 

The two valid codewords |0) and |1) in Shor's code are eigenvectors of all 
eight of these operators with eigenvalue +1. All the operators in Q that fix both 
|0) and |1) can be written as the product of these eight operators. The set of 
operators that fix |0) and |T) form a group S, called the stabilizer of the code, 
and Mi through M$ are the generators of this group. 

When we measure the eigenvalue of Mi , we determine if a bit flip error has 
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Table 3.1: The stabilizer for Shor's nine-qubit code 
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occurred on qubit one or two, i.e., if a x \ or a X 2 has occurred. Note that both 
of these errors anticommutc with M\, while a x3 through a x g, which cannot be 
detected by just M 1 , commute with it. Similarly, M 2 detects a x \ or a x s, which 
anticommute with it, and Mj detects a z \ through er 2 g. In general, if M G S, 
{M, E} = 0, and \i/>) € T, then 

ME\ip) = -EM\ip) = -E\4>), (3.1) 

so E\ijj) is an eigenvector of M with eigenvalue —1 instead of +1 and to detect 
E we need only measure M. 

The distance of this code is in fact three. Even a cursory perusal reveals 
that any single-qubit operator a X i, a y i, or a Z i will anticommute with one or 
more of M\ through Mg. Since states with different eigenvalues are orthogonal, 
condition ( |2.10 ) is satisfied when E a has weight one and Ej, — I. We can also 



check that every two-qubit operator E anticommutes with some element of S, 
except for those of the form a za <j z b where a and b are in the same block of three. 
However, the operators of this form are actually in the stabilizer. This means 
that o za <J z bW) = \4>) for any codeword and {ip\a za a z b\ f) — (ip\ip) = 1 for 
all codewords \ip), and these operators also satisfy equation ( 2.10 ). Since a za a z b 



is in the stabilizer, both a za and a z b act the same way on the codewords, and 
there is no need to distingui sh th em. When we get to operators of weight three, 
we do find some for which ( |2.10 ) fails. For instance, <j x \<t X 2<J x z commutes with 



everything in S, but 

(0\a xl a x2 <J x3 \0) = +1 (3.2) 

(T|(T a ;iCr 3; 2Cr a ;3|T) = -1. (3.3) 



3.2 The General Stabilizer Code 

The stabilizer construction applies to many more codes than just the nine- 
qubit one ^2|. In general, the stabilizer S is some Abelian subgroup of 
Q and the coding space T is the space of vectors fixed by S. Since a y has 
imaginary components, while a x and a z are real, with an even number of cry's 
in each element of the stabilizer, all the coefficients in the basis codewords can 
be chosen to be real; if there are an odd number of dy's, they may be imaginary. 
However, Rains has shown that whenever a (possibly complex) code exists, a 
real code exists with the same parameters Therefore, I will largely restrict 
my attention to real codes. 

For a code to encode k qubits in n, T has 2 fc dimensions and S has 2 n ~ k 
elements. S must be an Abelian group, since only commuting operators can 
have simultaneous eigenvectors, but provided it is Abelian and neither i nor —1 
is in S, the space T = {\ip) s.t. M\ip) = VM G S} does have dimension 2 k . 
At this point it will be helpful to note a few properties of Q. Since a x = <jy = 
a z = +1, every element in Q squares to ±1. Also, a x , a y , and a z on the same 
qubit anticommutc, while they commute on different qubits. Therefore, any 
two elements of Q either commute or they anticommute. a x , a y , and a z are all 
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Hermitian, but of course (il)^ = —il, so elements of Q can be either Hermitian 
or anti-Hermitian. In either case, if A £ Q, A^ £ G also. Similarly, cr Xl a y , and 
a z are all unitary, so every element of Q is unitary. 

As before, if M £ S, \ipi) £ T, and {M, E} = 0, then ME\ipi) = -E\tpi), so 

(Vi Wi) = = -{il>i\E\tl>i) = 0. (3.4) 



Therefore the code satisfies (2.8) whenever E = E\Eb = ±E a Ej, anticommutes 
with M for some M £ S. In fact, in such a case it also satisfies (^9|), since 
= {ij)j\E\ij)j) — 0. Therefore, if E^Ef, anticommutes with some ele- 
ment of S for all errors E a and Ef, in some set, the code will correct that set of 
errors. 

Of course, strictly speaking, this is unlikely to occur. Generally, I will be an 
allowed error, and E = Vl commutes with everything. However, S is a group, 
so I £ S. In general, if E £ S, 

(&Wi> = <lMk> = (3.5) 



This will satisfy equation (2.10) also. 

Now, there generally are many elements of Q that commute with everything 
in S but are not actually in S. The set of elements in Q that commute with all 
of S is defined as the centralizer C{S) of S in Q. Because of the properties of S 
and Q, the centralizer is actually equal to the normalizer N(S) of S in Q, which 
is defined as the set of elements of Q that fix S under conjugation. To see this, 
note that for any A <E Q, M e S, 

A^MA = ±A^AM = ±M. (3.6) 

Since -1 $ S, A e N{S) iff A £ C(S), so N{S) = C(S). Note that S C N(S). 
In fact, S is a normal subgroup of N(S). N(S) contains 4 • 2 n+k elements. The 
factor of four is for the overall phase factor. Since an overall phase has no effect 
on the physical quantum state, often, when considering N(S), I will only really 
consider N(S) without this global phase factor. 

If E £ N(S) — S, then E rearranges elements of T but does not take them 
out of T: if M £ S and \ip) £ T, then 

ME\i>) = EM\tp) = E\i>), (3.7) 

so E\ip) £ T also. Since E ^ S, there is some state in T that is not fixed by E. 
Unless it differs from an element of S by an overall phase, E will therefore be 
undetectable by this code. 

Putting these considerations together, we can say that a quantum code with 
stabilizer S will detect all errors E that are either in S or anticommute with 
some element of S. In other words, E £ S U (Q — N(S)). This code will correct 
any set of errors {E t } iff E a E b £ S U {Q - N(S)) ~iE a ,E b (note that E\E h 
commutes with M £ Q iff E a Eb = ±E\Eb does). For instance, the code will 
have distance d iff N(S) — S contains no elements of weight less than d. If 
S has elements of weight less than d (except the identity), it is a degenerate 
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code; otherwise it is a nondegenerate code. For instance, the nine-qubit code 
is degenerate, since it has distance three and a z \a Z 2 € S. A nondegenerate 
stabilizer code satisfies 



By convention, an [n, 0, d] code must be nondegenerate. When E a Eb € S, we 
say that the errors E a and Et are degenerate. We cannot distinguish between 
E a and Et,, but there is no need to, since they have the same effect on the 
codewords. 

It is sometimes useful to define the error syndrome for a stabilizer code. Let 
Im ■ G — > Z 2 , 



and f(E) = (f Ml (E), . . . , fM n - k (E)), where Mi, ... , M„_ fc are the generators 
of S. Then f(E) is some (n — fc)-bit binary number which is iff E G N(S). 
f(E a ) — f(Eb) iff f(E a Eb) = 0, so for a nondegenerate code, f(E) is different 
for each correctable error E. 

In order to perform the error-correction operation for a stabilizer code, all 
we need to do is measure the eigenvalue of each generator of the stabilizer. 
The eigenvalue of Mi will be (— l)-^^, so this process will give us the error 
syndrome. The error syndrome in turn tells us exactly what error occurred 
(for a nondegenerate code) or what set of degenerate errors occurred (for a 
degenerate code). The error will always be in Q since the code uses that error 
basis, and every operator in Q is unitary, and therefore invertible. Then we just 
apply the error operator (or one equivalent to it by multiplication by S) to fix 
the state. Note that even if the original error that occurred is a nontrivial linear 
combination of errors in Q, the process of syndrome measurement will project 
onto one of the basis errors. If the resulting error is not in the correctable set, 
we will end up in the wrong encoded state, but otherwise, we are in the correct 
state. In chapter [| I describe a few ways of measuring the error syndrome that 
are tolerant of imperfect component gates. 

Since the elements of N(S) move codewords around within T, they have a 
natural interpretation as encoded operations on the codewords. Since S fixes 
T, actually only N(S)/S will act on T nontrivially. If we pick a basis for T 
consisting of eigenvectors of n commuting elements of N(S), we get an auto- 
morphism N(S)/S — > Gk- N(S)/S can therefore be generated by i (which we 
will by and large ignore) and 2k equivalence classes, which I will write Xi and 
Zi (i = 1 . . .k), where Xi maps to a X i in Qk and Zi maps to o~ Z i in Qk. They 
are encoded a x and a z operators for the code. If k = 1, I will write X\ = X 
and Z\ = Z. The X and Z operators satisfy 



(3.8) 




(3.9) 



[Xi, Xj] 
{Xi,Zi} 



0. 











(i + j) 



(3.10) 
(3.11) 
(3.12) 
(3.13) 
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O z 


O z 


O z 


O z 


Oz 



Table 3.2: The stabilizer for the five-qubit code. 



3.3 Some Examples 

I shall now present a few short codes to use as examples. The hrst encodes one 



qubit in five qubits tVA [24| and is given in table I have also included X and 
Z, which, along with Mi through M4, generate N(S). Note that this code is 
cyclic (i.e., the stabilizer and codewords are invariant under cyclic permutations 
of the qubits). It has distance three (for instance, o y \o z io y z € N(S) — S) and 
is nondegenerate. We can take the basis codewords for this code to be 



|0) = ^2 M I 00000 ) ( 3 - 14 ) 

and 



Mes 



\l)=X\0). (3.15) 



That is, 



|0) = 100000) + Mi 1 00000) + M 2 1 00000) + M 3 \ 00000) + M 4 | 00000) 
+ Mi M 2 100000) + Mi M 3 1 00000) + M X M 4 \ 00000) 
+ M 2 M 3 |00000) + M 2 M 4 |00000) + M 3 M 4 |00000) (3.16) 
+ MiM 2 M 3 |00000) + MiM 2 M 4 |00000) + MiM 3 M 4 |00000) 
+ M 2 M 3 M 4 |00000) + MiM 2 M 3 M 4 |00000) 
= 100000) + |10010) + 101001) + |10100) 
+ 101010) - |11011) - 100110) - 111000) 

- |11101) - 100011) - 111110) - 101111) (3.17) 

- 1 10001) - 101100) - 110111) + 100101), 

|T) = X\0) 

= 111111) + 101101) + 110110) + 101011) 
+ |10101) - 100100) - 111001) - loom) 

- 100010) - 1 11100) - 100001) - 110000) (3.18) 

- 101110) - |10011) - 101000) + 111010). 

Since multiplying by an element of the stabilizer merely rearranges the sum 
M, these two states are in T. When these are the encoded and 1, X is the 



and 
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o z 


I 


I 
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I 


Oz 


I 


O z 


I 


Oz 
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I 
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I 


I 


I 


O z 


Oz 


Oz 


O z 



Table 3.3: The stabilizer for the eight-qubit code. 



encoded bit flip operator a x and Z is the encoded o z . This code also has the 
property that every possible error syndrome is used by the single-qubit errors. 
It is therefore a perfect code. There are a number of other perfect codes (2^, |2(| , 
which will be discussed in chapter || 



A code encoding three qubits in eight qubits |21|, |22j, |27| appears in table 3.3. 
Again, Mi through M5 generate the stabilizer, and generate N(S) with Xi and 
Zi. This is also a nondegenerate distance three code. The codewords are 

\cTc2cl) =X c 1 1 X c 2 2 X~l 3 M|00000000). (3.19) 

Mes 

The operators Xi and Zi are the encoded o x and o z on the ith encoded qu- 
bit. This code is one of an infinite family of codes j2l], p8[ , which I present in 
chapter ||. 

A particularly useful class of codes with simple stabilizers is the Calderbank- 
Shor-Steane (or CSS) class of codes [|9[ |o). Suppose we have a classical code 
with parity check matrix P. We can make a quantum code to correct just o x 
errors using a stabilizer with elements corresponding to the rows of P, with a o z 
wherever P has a 1 and I's elsewhere. The error syndrome f(E) for a product 
of o x errors E is then equal to the classical error syndrome for the same set of 
classical bit flip errors. Now add in stabilizer generators corresponding to the 
parity check matrix Q of a second classical code, only now with cr x 's instead of 
er z 's. These generators will identify a z errors. Together, they can also identify 
o y errors, which will have a nontrivial error syndrome for both parts. In general, 
a code formed this way will correct as many a x errors as the code for P can 
correct, and as many <r z errors as the code for Q can correct; a o y error counts 
as one of each. 

We can only combine P and Q into a single stabilizer in the CSS form if 
the generators derived from the two codes commute. This will be true iff the 
rows of P and Q are orthogonal using the binary dot product. This means that 
the dual code of each code must be a subset of the other code. The minimum 
distance of the quantum code will be the minimum of the distances of P and 
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O z 



Table 3.4: The seven-qubit CSS code. 



Q. An example of a code of this sort is given in table 3.4. It is based on the 



classical [7, 4, 3] Hamming code, which is self-dual. For this code, the codewords 



are 



|0> = 10000000) + 11111000) + 11100110) + |1010101) 

+ 10011110) + 10101101) + 10110011) + |1001011) (3.20) 



and 



|1) = 10000111) + |imm) + 11100001) + 11010010} 

+ 10011001) + |0101010) + 10110100) + 1 1001 100}. (3.21) 

The encoded |0) state is the superposition of the even codewords in the Hamming 
code and the encoded |1) state is the superposition of the odd codewords in the 
Hamming code. This behavior is characteristic of CSS codes; in general, the 
various quantum codewords are superpositions of the words in subcodes of one 
of the classical codes. 

CSS codes are not as efficient as the most general quantum code, but they 
are easy to derive from known classical codes and their simple form often makes 
them ideal for other purposes. For instance, the seven-qubit code is particularly 
well suited for fault-tolerant computation (as I will discuss in chapter |5|) . 



3.4 Alternate Languages for Stabilizers 

There are number of possible ways of describing the stabilizer of a quantum 
code. They each have advantages and are useful in different circumstances. 
The description I have used so far uses the language of finite group theory and 
is particularly useful for making contact with the usual language of quantum 
mechanics. This is the form presented in [ pl| . 

We can instead write the stabilizer using binary vector spaces, as in p2fl , 
which emphasizes connections with the classical theory of error-correcting codes. 
To do this, we write the stabilizer as a pair of {n — k) x n binary matrices (or 
often one (n — k) x 2n matrix with a line separating the two halves). The 
rows correspond to the different generators of the stabilizer and the columns 
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correspond to different qubits. One matrix has a 1 whenever the generator has 
a o x or a a y in the appropriate place, the other has a 1 whenever the generator 
has a <j y or a z . Overall phase factors get dropped. For instance, the five-qubit 
code in this form becomes 



/ 1 1 

10 1 

10 10 

\ 1 1 



110 0^ 

110 

1 1 

1 1 / 



(3.22) 



Other elements of Q get converted to two n-dimensional vectors in the same way. 
We can convert back to the group theory formalism by writing down operators 
with a a x if the left vector or matrix has a 1, a a z if the right vector or matrix 
has a 1, and a a y if they are both 1. The generators formed this way will 
never have overall phase factors, although other elements of the group might. 
Multiplication of group elements corresponds to addition of the corresponding 
binary vectors. 

In the binary formalism, the condition that two operators commute with 
each other becomes the condition that the following inner product is 0: 



Q(a\b, c\d) = y^(ajrfj + bfa 



0. 



(3.23) 



using binary arithmetic as usual, dj, bi, Ci, and di are the zth components of the 
corresponding vectors. Therefore the condition that the stabilizer be Abelian 
converts to the condition that the stabilizer matrix (A\B) satisfy 



Y J {AuB 3 i+B ll A 3 i)=Q. 



(3.24) 



i=i 



Wc determine the vectors in N{S) by evaluating the inner product (3.23) with 
the rows of (A\B). To get a real code (with an even number of (T y 's), the code 
should also satisfy 



^A u B u = 0. 



(3.25) 



i=i 



Another formalism highlights connections with the classical theory of codes 
over the field GF(4) ^(|. This is a field of characteristic two containing four 
elements, which can be written {0, 1, w, to 2 }- Since the field has characteristic 
two, 



1 + 1= UJ + LU = UJ 



= 0. 



(3.26) 

Also, to 3 = 1 and 1 + lo = uj 2 . We can rewrite the generators as an n-dimensional 
"vector" over GF(4) by substituting 1 for a x , uj for cr z , and oj 2 for a y . The 
multiplicative structure of Q becomes the additive structure of GF(4). I put 
vector in quotes because the code need not have the structure of a vector space 
over GF(4). If it does (that is, the stabilizer is closed under multiplication by 
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lo), the code is a linear code, which is essentially a classical code over GF(4). 
The most general quantum code is sometimes called an additive code, because 
the stabilizer is only closed under sums of its elements. In this formalism, the 
five-qubit code appears as 



/ 1 LO 


LO 


1 


^ 


1 


LO 


LO 


1 


1 


1 


LO 


LO 


\ LO 1 





1 


LO J 



(3.27) 



Note that the five-qubit code is a linear quantum code. 

Again, there is an additional condition for a quantum code. Define the 
"trace" operator by Tr uo = Tr to 2 = 1, Tr 1 = Tr = 0. Two operators in Q 
commute iff their images, the vectors u and v over GF(4), satisfy 

Tr u ■ v = Tr j = °> ( 3 - 28 ) 

where Vj is conjugation on the jth component of v, switching lo and lo 2 , and 
leaving and 1 alone. 



3.5 Making New Codes From Old Codes 

Using old codes to find new ones can simplify the task of finding codes, which 
can otherwise be quite a difficult problem. There are a number of simple mod- 
ifications we can make to existing codes to produce new codes with different 
parameters |2f| |2(| . 

One trivial change is to perform a permutation of a x , a y , and a z on each 
qubit. This leaves the distance and size of the code the same, although it may 
be useful for codes that can correct different numbers of a x , cr y , and a z errors. A 
slightly less trivial manipulation is to add a new qubit and a new generator which 
is a x for the new qubit. The other generators are tensored with the identity on 
the new qubit to form the generators of the new code. This makes an [n, k, d] 
code (degenerate or nondegenerate) into an [n + l,k,d] degenerate code: Any 
operator acting as a y or a z on the new qubit will anticommute with the new 
generator, and any operator with the form M <g> <r x (n+i) w * u be equivalent to 
the operator M <g> I. Therefore, an operator must have at least weight d when 
restricted to the first n qubits to be in N(S) — S. 

A less trivial manipulation is to remove the last qubit, converting an [n,k,d] 
code into an [n— 1, k + 1, d— 1] code. To do this, we choose the n — k generators 
of S so that M\ ends a x , M 2 ends a z , and M 3 through M n _£ end /. We can 
always do this when d > 1 by picking the first two and then multiplying by 
combinations of them to make the others end appropriately.^] Then the new 

1 If the code has been formed by adding a single a x (or a y or cr z ) generator, as above, we 
may not be able to do this for a given qubit, but there will always be at least one qubit for 
which we can. 
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Table 3.5: A [4, 2, 2] code derived from the [5, 1, 3] code. 



code has a stabilizer formed from the last n — k — 2 generators, dropping Mi 
and M 2 . Suppose we have an operator A on the first n — 1 qubits of weight w 
that commutes with M3 through M n ^k- There are four possibilities, all of which 
lead to an operator of weight at most w + 1 that commutes with the original 
stabilizer: 

1. A commutes with both Mi and M 2 - 

2. A commutes with Mi, but not M 2 . Then A®a xn commutes with Mi and 
M 2 . 

3. A commutes with M 2 , but not Mi. Then A®a zn commutes with Mi and 
M 2 . 

4. A anticommutes with both Mi and M 2 . Then A ® <j yn commutes with 
Mi and M 2 . 

Since the original code had distance d, w must be at least d—1, which is therefore 
the distance of the new code. The stabilizer has n — k — 2 generators, so the code 
encodes (n — 1) — (n — k — 2) = k + 1 qubits. The new X and Z operators are 
Mi and M 2 (in either order), restricted to the first n— 1 qubits. An example of 



this construction is to remove the last qubit from the [5, 1, 3] code of figure 4.2 



to produce a [4,2,2] code: the generators of the new code are Mi and M3M4, 



both without the last qubit. The new stabilizer is given in figure 3.5, Note that 
the Z\ operator is equal to M3Z for the five-qubit code. I have multiplied by 
M3 so that Zi anticommutes with X x . 

Another way to make new codes is by pasting together old codes. Suppose 
we have four stabilizers R%, R 2 , Si, and S 2 , with Ri C Si and R 2 C S 2 . Let 
Ri define an [m,/i,ci] code, R 2 be an [712,^2,02] code, Si be an [m,fci,di] 
code, and S 2 be an [^2,^2,^2] code. Then ki < U and a < di. We require 
l x — ki = I2 — k 2 and for 5*1 and S2 to be nondegenerate.0 Let generators of Ri 
be {Mi, . . . , M ni -i 1 }, the generators of Si be {Mi, . . . , M^-^}, the generators 
of i?2 be {A^i, . . . , A„ 2 _; 2 }, and the generators of S 2 be {Ni, . . . , 7V„ 2 _fc 2 }. We 
form a new stabilizer S on rii + n 2 qubits generated by 

{Mi <g> I, . . . , M n ^ h <g> I, I ® JVi, . . . , i" <g> N n2 _ h , 

M ni _ il+ i ® N n2 „ h+ i, . . .,M ni _ fel 2) N n ^ k2 }. (3.29) 



2 We can actually allow 5i and 52 to be degenerate, as long as all the degenerate operators 
are confined to Ri and R2 
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Table 3.6: The thirteen-qubit code formed by pasting together the five- and 
eight-qubit codes. 



The code has (n% — h) + (n 2 — l 2 ) + (U — h) generators, and therefore en- 
codes h + &2 = h + ki qubits. For instance, if Si is the eight-qubit code 
and S2 is the five-qubit code, with R± generated by o x OxOxOxOxOxOxO x and 
OzOzOzOzO z o z OzOz and R2 generated by o x o z o z o x I, we can make the [13, 7,3] 
code given in table 3.6. 

In general, the distance of the new code will be min{<ii, d 2 , C\ + C2}. This is 
because an operator acting on just the first n\ qubits can only commute with 
S if it commutes with Si, an operator acting on the last n 2 qubits can only 
commute with S if it commutes with S2 , and an operator acting on both parts 
must commute with both R\ I and I <g> R 2 . 

Another very useful way of producing new codes is to concatenate two codes 
to produce a code of greater total distance. Suppose we have an [n±, k, di] code 
(stabilizer Si) and we encode each of its n\ qubits again using an [712, 1, d 2 ] code 
(stabilizer S2). The result is an [nin 2 , k, d\d 2 ] code. Its stabilizer S is n\ copies 
of S2, acting on the physical qubits in blocks of size n 2 , plus an additional n\ — k 
generators corresponding to the generators of Si. However, these generators are 
encoded to act on the second code. That is, a o x acting on the first code must 
be replaced by an X for the second code. For instance, the code resulting f rom 
concatenating the five-qubit code with itself has the stabilizer given in table 3.7. 
The concatenated code has distance d\d 2 because operators in N(S) — S must 
have distance at least d 2 on at least d\ blocks of n 2 qubits, so have weight at 
least d\d 2 . Note that it is not strictly necessary to use the same code to encode 
each qubit of Si . 

There are two possible ways to concatenate when S2 encodes multiple qubits. 
Suppose Si is an [m, ki,di] code and S2 is an [n 2 , k 2 , d 2 ] code. Further, suppose 
m is a multiple of k 2 . Then we can encode blocks of Si of size k 2 using S2. 
This will result in a code using n\n 2 jk 2 qubits to encode k\ qubits. It still takes 
an operator of distance at least d 2 to cause an error on an 712-qubit block, but 
such an error can cause up to k 2 errors on Si, so the resulting code need only 
have distance \di/k 2 ~\d 2 . However, the k 2 errors that result are not a general 
set of k 2 errors, so the code may actually be better. Suppose Si has distance 
d[ (d'i > \di/k 2 ]) for blocks of k 2 errors, i.e., d[ such blocks must have errors 
before the code fails. Then the concatenated code has distance d[d 2 . 

Another way to concatenate codes encoding multiple qubits is to add addi- 
tional blocks of Si to fill the spaces in S2. That is, we actually encode k 2 copies 
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I 


I 


I 


I 


I 


O'x 


O'x 






O'x 


0-z 


0-z 


0-z 


O z 


O z 


O z 


O z 


O z 


O z 


O z 


M24 


O z 


0-z 


0-z 


0-z 


0- z 


Ox 


(Tx 


O'x 


O'x 


O'x 


I 


I 


I 


I 


I 


O'x 


Ox 


Ox 


Ox 


O x 


O z 


O z 


Oz 


O z 


O z 



Table 3.7: Result of concatenating the five-qubit code with itself. 
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of Si, encoding the ith qubit of each copy in the same S2 block. This produces 
an [nin2,kik2,did,2\ code, since any failure of an S2 block only produces one 
error in each Si block. 

3.6 Higher Dimensional States 

So far, we have only considered systems for which the Hilbert space is the tensor 
product of two-state systems. However, it may turn out that a good physical 
implementation of quantum computation uses three- or four-level atoms, or 
spin-one particles, or some other system where it makes more sense to consider 
it as the tensor product of d-dimensional systems, where d > 2. I will call 
the fundamental unit of such a system a qudit. In such a case, we will want 
to consider error correcting codes where a single qudit error can occur with 
reasonable probability. For these systems, the stabilizer code formalism needs 
to be modified to deal with the extra dimensions. 

Fundamental to the success of the stabilizer formalism was the use of the 
Pauli spin matrix basis for possible errors. The algebraic properties of this 
basis allowed a straightforward characterization of errors depending on whether 
they commuted or anticommuted with elements of an Abelian group. Knill plf 
has codified the properties necessary for this construction to generalize to d- 
dimensional spaces. Suppose we have a set of d 2 unitary operators Ei, ... , E n 2 
(including the identity) acting on a single qudit such that the E^s form a basis 
for all possible dx d complex matrices. If EiEj = WijE^j for all i, j (where * is 
some binary group operation), then the E^s are said to form a nice error basis. 
The values lUy will then have modulus one. Given a nice error basis, we form 
the group Q n for this basis as the tensor product of n copies of the error basis, 
with possible overall phases generated by the my's. Then an Abelian subgroup 
S of Q n that does not contain any nontrivial phase times the identity will have 
a nontrivial set T of states in the Hilbert space in the +1 eigenspace of every 
operator in S. The code T can detect any error E for which EM = cME for 
some M £ Q n and some 1. 

One interesting complication of codes over d-dimensional spaces is that when 
S has n — k generators, T need not encode k qudits. This can only occur when 
d is composite and the order of a generator of S is a nontrivial factor of d. It is 
still true that if S has r elements, then T will be (d n /r)-dimensional. If all the 
generators of S have order d, T does encode k qudits. 

One particularly convenient error basis for any d is generated by and 
C n , where (-D w )ij = 5ijOJ l and {C n )ij = $j,(i+i mod n)- ^ is a primitive nth root 
of unity. For d = 2, this just reduces to the usual Pauli basis, since C2 = cr x 
and D—i = a z . For higher d, D u maps \i) — > u) l \i) and C n adds one modulo n. 
This is a nice error basis, with 




(3.30) 



The elements of the basis can be written C^D^, and 




(3.31) 
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Codes for higher-dimensional systems have not been as extensively studied 
as those for two-dimensional systems, but some constructions are given in pl| , 
£2|,£3|,EI|35|. 
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Chapter 4 

Encoding and Decoding 
Stabilizer Codes 



4.1 Standard Form for a Stabilizer Code 

To see how to encode a general stabilizer code ]3(|, it is helpful to describe 
the code in the language of binary vector spaces (see section 3.4). Note that 
the specific choice of generators is not at all unique. We can always replace 
a generator Mj with MiMj for some other generator Mj. The corresponding 
effect on the binary matrices is to add row j to row i in both matrices. For 
simplicity, it is also helpful to rearrange qubits in the code. This has the effect of 
rearranging the corresponding columns in both matrices. Combining these two 
operations, we can perform Gaussian elimination on the first matrix, putting 
the code in this form: 



r{ 
r{ 



I 




n—r 


r 


n—r 











D 


E 



(4.1) 



Here, r is the rank of the a x portion of the stabilizer generator matrix. 
Then we perform another Gaussian elimination on E to get 




-k—r—s 


k+s 


r 


n—k—r— s 


k+s 






"zT 












Di 


I 


E 2 








D 2 









(4.2) 



The rank of E is n— fc — r — s. However, the first r generators will not commute 
with the last s generators unless D 2 = 0, which really implies that s = 0. Thus 
we can always put the code into the standard form 

—k—T k 



r{ 

k — r{ 



r 


n — k — r 


k 


T 


i 




'a? 













D 



Ci 

I 



c 2 

E 



(4.3) 
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For instance, the standard form for the five-qubit code of table 3.2 is 



/ 1 1 

10 1 

10 1 

y o o o i i 



1 1 1 1 \ 
110 
110 
10 111/ 



(4.4) 



Suppose we have an X operator which in this language is written (u\v) — 
(uiU2Us\viV2V3) , where u\ and v\ are r-dimensional vectors, u 2 and vq. are 
(n — k — r)-dimensional vectors, and U3 and D3 are fc-dimensional vectors. How- 
ever, elements of N(S) are equivalent up to multiplication by elements of S. 
Therefore, we can also perform eliminations o n X to force u\ = and v 2 = 0. 
Then, because X is in N(S), we must satisfy ( 3.23| ), so 



I A 1 A 2 B d C 2 
D I E 



( «r \ 



u 3 



T 

\ "3 



vf + A 2 vJ + Cml + C 2 u\ 



En? 



(4.5) 



Suppose we want to choose a complete set of k X operators. We can combine 
their vectors into two k x n matrices (OC/2 1 V1OV3). We want them to commute 
with each other, so U3V3 + V3llT = 0. Suppose we pick U3 = I. Then we can 



take V 3 = 0, and by equation flOj) , U 2 = E T and Vi = E T C? + Cj. The 
rest of the construction will assume that this choice has actually been made. 
Another choice of t/3 and V3 will require us to perform some operation on the 
unencoded data to compensate. For the five-qubit code, the standard form of 
the X generator would be (00001 1 10010). We can see that this is equivalent 
(mod S) to the X given in table |3.2| . 

We can also pick a complete set oik Z operators, which act on the code as 
encoded a z operators. They are uniquely defined (up to multiplication by S, as 
usual) given the X operators. Z% is an operator that commutes with M G S, 
commutes with Xj for i =/= j, and anticommutes with Xi. We can bring it into 
the standard form (0U^\V{0V^). Then 



U!sV 3 T 



(4.6) 



When 1/3 = 1 and V3 = 0, V 3 ' = I. Since equation (4.5) holds for the Z 



operators too, U 2 = U 3 = and V{ = A\. For instance, for the five-qubit code, 
the standard form of the Z generator is (00000| 11111), which is exactly what is 
given in table 3.2. 
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4.2 Network for Encoding 

Given a stabilizer in standard form along with the X operators in standard 
form, it is straightforward to produce a network to encode the corresponding 
code. The operation of encoding a stabilizer code can be written as 



ci 



■Cfc) 



\M 

= (I + M t ) 



£mW-..jC|o. 

\ies I 



.0) 



(I+M n _ k jX? 



(4.7) 



■X c k k \0...0), (4.8) 



where Mi through M n _fc generate the stabilizer, and Xi through X k are the 
encoded a x operators for the k encoded qubits. This is true because, in general, 
for any N £ S, 




J2 nm] iv) = ( E m ' ) w> 

Mes ) \M'eS / 



(4.9) 



so ^2 M\ip) is in the coding space T for any state If we define the encoded 
as 



|0) = £ M|0^0), 



Mes 



then by the definition of the X's, we should encode 



(4.10) 



■Cfc) 



M M0...0). 



(4.11) 



Since commutes with M € S, this is just (4.7). Naturally, to encode this, 
we only need to worry about encoding the basis states |ci . . . Cfc). 

The standard form of Xi has the form X 1 -"-^ : a x{n _ k+i) [Z^ is the 
product of cr z 's on the first r qubits and x^ n ^ k ^ r ^ is the product of tr^'s on the 
next n — k — r qubits). Suppose we put the A:th input qubit |cfc) in the nth 
spot, following n — 1 0s. The state X^. fc |0 . . .0) therefore has a 1 for the nth 
qubit iff |cfc) = |1). This means we can get the state X fe fc |0. . . 0) by applying 
Xk (without the final a xn ) to the input state conditioned on the nth qubit. For 
instance, for the five-qubit code , X = Z®I®I®Z®X. The corresponding 
operation is illustrated in figure 4.1. In this case r = n — k = 4, so there are no 
bit flips, only controlled a z 's. 

In the more general case, we also need to apply X\ through Xk-i, depending 
on ci through Cfc_i. Since the form of the JT's ensures that each only operates 
on a single one of the last k qubits, we can substitute \ci) for the (n — k + i)th 
qubit and apply Xi conditioned on it, as with |cfc). This produces the state 

x c 1 1 ---x c k k \o...o). 

Further, note that the X operators only act as a z on the first r qubits and 
as <J X on the next n — k — r qubits. Since a z acts trivially on |0), we can just 
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— <?z — 











— <J Z — 



c 



Figure 4.1: Creating the state X\ 00000) for the five-qubit code. 

ignore that part of the X's when implementing this part of the encoder, leaving 
just the controlled NOTs. The first r qubits automatically remain in the state 
|0) after this step of encoding. This means that for the five-qubit code, this step 
of encoding is actually trivial, with no operations. In general, this step is only 
necessary if r < n — k. 

For the next step of the encoding, we note that the standard form of the 
first r generators only applies a single bit flip in the first r qubits. This means 
that when we apply I + M i: the resulting state will be the sum of a state with 
|0) for the ith qubit and a state with |1) for the ith qubit. We therefore apply 
the Hadamard transform 



to the first r qubits, putting each in the state |0) + |1). Then we apply Mi (for 
i = 1, . . . , r) conditioned on qubit i (ignoring the factor of a X i)- While these 
operators may perform phase operations on the first r qubits, they do not flip 
them, so there is no risk of one operation confusing the performance of another 
one. The one possible complication is when M, has a factor of a Z i. In this case, 
a Z i only introduces a minus sign if the qubit is |1) anyway, so we do not need 
to condition it on anything. Just performing a z i after the Hadamard transform 
is sufficient. For the five-qubit code, the full network for encoding is given in 



For more general codes, r < n—k, and there are n — k — r generators that are 
formed just of the tensor product of o>'s. However, we do not need to consider 
such generators to encode. Let M be such a generator. Since M commutes 
with all the other generators and every X, we can commute I + M through 
until it acts directly on |0 ... 0). However, a z acts trivially on |0), so I + M fixes 
|0 . . . 0), and in equation (p~g|), we can skip any Mi that is the tensor product of 
er z 's. The effect of these operators is seen just in the form of the X operators, 
which must commute with them. 

Applying each of the X operators requires up to n — k — r two-qubit opera- 
tions. Each of the first r qubits must be prepared with a Hadamard transform 
and possibly a a z , which we can combine with the Hadamard transform. Then 




(4.12) 



figure 4.2. 
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R 
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Figure 4.2: Network for encoding the five-qubit code. 



applying each of the first r generators requires up to n— 1 two-qubit operations. 
The whole encoder therefore requires up to r one-qubit operations and at most 

k(n-k-r) + r(n - 1) < (k + r)(n - Jfe) < n(n - k) (4.13) 

two-qubit operations. 



4.3 Other Methods of Encoding and Decoding 

We can decode a code by performing the above network in reverse. In order 
to do this, we should first perform an error correction cycle, since the network 
will not necessarily work properly on an encoded state. Note that in principle 
we can build a decoder that corrects while decoding. We can form a basis for 
the Hilbert space from the states A\ipi), where A S Q and \ipi) is a basis state 
for the coding space T. The combined corrector/decoder would map A\ipi) to 
\i) <8> \f(A)), where f(A) is the error syndrome for A. If A is not a correctable 
error, \i) will not necessarily be the state encoded by but if A is correctable, 
it will be. It is not usually worthwhile using a quantum network that does 
this, since the error correction process is usually dealt with more easily using 
classical measurements. However, some proposed implementations of quantum 
computation cannot be used to measure a single system |J, so this sort of 
network would be necessary. The decoding method presented in J37| can easily 
be adapted to produce networks that simultaneously correct and decode. 

One good reason not to decode by running the encoder backwards is that 
most of the work in the encoder went into producing the encoded 0. There is 
no actual information in that state, so we might be able to save time decoding 
if we could remove the information without dealing with the structure of the 
encoded 0. We can do this by using the X and Z operators. If we want to 
measure the ith encoded qubit without decoding, we can do this by measuring 
the eigenvalue of Zi. If the eigenvalue is +1, the zth encoded qubit is |0); if it 
is —1, the zth encoded qubit is In standard form, Zi is the tensor product 
of er z 's. That means it will have eigenvalue {—l) p , where P is the parity of the 
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qubits acted on by Zi. Therefore, if we apply a controlled-NOT from each of 
these qubits to an ancilla qubit, we have performed a controlled-NOT from the 
ith encoded qubit to the ancilla — we will flip the ancilla iff the ith encoded 
qubit is |1). 

If the original state of the code is |0) + 1 1) \<j>) (with the first ket represent- 
ing the ith logical qubit) and the ancilla begins in the state |0), after applying 
this CNOT operation, we have 

|O)hA)|O) + |T)|0)|l). (4.14) 

Now we apply Xi conditioned on the ancilla qubit. This will flip the ith encoded 
qubit iff the ancilla is |1). This produces the state 

|0M|0> + |0)|^>|l) = |fi> (M|0> + (4.15) 

The ith encoded qubit has been set to and the ancilla holds the state that the 
ith encoded qubit used to hold. The rest of the code has been left undisturbed. 
We can repeat this operation with each of the encoded qubits, transferring them 
to k ancilla qubits. Each such operation requires at most 2(n — k + 1) two-qubit 
operations (since Z requires at most r+1 operations and X could require n— k+1 
operations). Therefore, the full decoder uses at most 2k(n — k + 1) operations, 
which is often less than is required to encode. At the end of the decoding, the 
original n qubits holding the code are left in the encoded state. 

We can run this process backwards to encode, but we need an encoded 
state to begin with. This could be a residue from an earlier decoding operation, 
or could be produced separately. One way to produce it would be to use the 



network of section 4.2, using |0. . .0) as the input data. Alternately, we could 
produce it by performing an error correction cycle on a set of n |0)'s for the sta- 
bilizer generated by Mi, . . . M n _fc, Z%, . . . , Z^. This stabilizer has n generators, 
so there is only one joint +1 eigenvector, which is just the encoded for the 
original code. 
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Chapter 5 



Fault- Tolerant Computation 



5.1 Encoded Computation and Fault-Tolerance 

I have shown how to encode qubits in blocks to protect them from individual 
errors. This, by itself, is useful for transmitting quantum data down a noisy 
communications line, for instance — we can encode the data using the code, send 
it, correct the errors, and decode it. Then we can process the data normally. 
However, the framework so far is insufficient for performing computations on a 
realistic quantum computer. If we need to decode the data in order to perform 
quantum gates on it, it is vulnerable to noise during the time it is decoded. 
Even if we know how to perform gates on the data while it is still encoded, we 
must be careful to make sure that a single error does not cause us to accidentally 
perform the wrong computation. 

For instance, suppose a single qubit has been flipped and we apply a con- 
trolled-NOT from it to another qubit. Then the second qubit will flip exactly 
when it is supposed to stay the same. In consequence, now both the first and 
the second qubits have bit flip errors. If both qubits are part of the same block, 
we now have two errors in the block instead of one. Before very much of this 
occurs, we will have too many errors in the block to correct. If we correct errors 
often enough, we can salvage the situation jj4| , but in the process we lose a lot 
of the power of the error-correcting code. Therefore, I will define a fault-tolerant 
operation as one for which a single error introduces at most one error per block 
of the code. In a large computer, we have many encoded blocks of data, and a 
given operation may introduce one error in a number of them. However, each 
block retains its ability to correct that single error. 

In the example above, an error propagated forward from the control qubit to 
the target qubit of the CNOT. In a quantum computer, errors can also propagate 
backwards. For instance, suppose we have the state 



(a|0)+/3|l»(|0)±|l» 



(5.1) 
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and perform a CNOT from the first qubit to the second. The resulting state is 

a|0)(|0) ± |1» +/3|1)(±1)(|0) ± |1)) = HO) ±/3|l))(|0) ± |1». (5.2) 

Initially flipping the sign on the second qubit will result in a sign flip on the 
first qubit after the CNOT. In a CNOT, amplitude (bit flip) errors propagate 
forwards, and phase errors propagate backwards. 

This means that not only must we make sure not to perform operations from 
one qubit to another within a block, we must also be sure not to perform multiple 
CNOTs from a block onto the same target qubit, even if it is a disposable ancilla 
qubit. Otherwise, a single phase error in the ancilla qubit can produce multiple 
errors within a block. Operations for which each qubit in a block only interacts 
with the corresponding qubit, either in another block or in a specialized ancilla, 
will be called transversal operations. Any transversal operation is automatically 
fault-tolerant, although there are some fault-tolerant operations which are not 
transversal. 

5.2 Measurement and Error Correction 

Suppose we want to measure the operator a z \a Z 2, as with Shor's nine-qubit 
code. The eigenvalue is +1 if both qubits are the same and —1 if they are 
different. One natural way to do this is perform a CNOT from both qubits to 
a third ancilla qubit, initially in the state |0). If both qubits are |0), the ancilla 
is left alone, and if both are |1), the ancilla gets flipped twice, returning to the 
state |0). If only one of the two qubits is |1), the ancilla only flips once, ending 
up in the state |1). Measuring the ancilla will then tell us the eigenvalue of 
c z icr z2 . 

However, this procedure is not a transversal operation. Both qubits interact 
with the same ancilla qubit, and a single phase error on the ancilla qubit could 
produce phase errors in both data qubits, producing two errors in the block 
(actually, this particular example does not have this problem, since a phase 
error on the ancilla qubit is meaningless until after it has interacted with the 
first data qubit; but if we were measuring a z \<j Z ?,(J z $ instead, the problem would 
be a real one). One possible solution to the problem is to use two ancilla qubits, 
both initially |0), instead of one. Then we perform CNOTs from the first data 
qubit to the first ancilla qubit and from the second data qubit to the second 
ancilla qubit. Then we measure the ancilla qubits and determine their parity. 
This will again tell us the eigenvalue of <j z i<j Z 2, and we do not run the risk of 
introducing two phase errors into the data. 

However, we have instead done something worse. By measuring both ancilla 
qubits, we have, in effect, measured the original data qubits, which destroys 
any superposition of the +I-eigenstates of a z \u Z 2- To make this work, we need 
to be able to measure the ancilla without finding out anything about the data. 
Since we are only interested in the parity of the data qubits, we could have just 
as well started the ancilla in the state 1 11} as |00). If both or neither ancilla 
qubits are flipped, the parity is still even, and if only one is flipped, the parity 
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is odd, as it should be. However, measuring the ancilla still tells us what states 
the data qubits were in. The state of a data qubit is equal to the reverse of the 
measured state of the corresponding ancilla qubit. 

This means if we start the ancilla in the superposition |00) + |11) and perform 
CNOTs from the data qubits to the ancilla qubits, measuring the ancilla will 
again tell us the parity of the data qubits. However, we do not know whether 
the state we measure originally corresponded to the ancilla state |00) or |11), 
which means we cannot deduce the state of the data. The two ancilla states 
correspond to the two possible states of the data qubits with the same parity. 
This means that measuring the ancilla does not destroy a superposition of these 
two states of the data. This is what we desired. 

Because we interact each data qubit with a separate ancilla qubit, a single 
phase error in the ancilla will only produce a single phase error in the data. Of 
course, if a single qubit in the ancilla flips so we start in the state 1 01) + 1 10) , 
we will measure the wrong parity. We can circumvent this problem by simply 
preparing multiple ancillas in the same state, performing the CNOTs to each of 
them, and measuring each. If we prepare three such ancillas and determine the 
parity as the majority result, the answer will be correct unless two errors have 
occurred. If the chance of a single error is e, the chance of getting two errors in 
the data or getting the wrong measurement result is 0(e 2 ). 

We can use this trick on products of more than two a z operators Q by 
preparing the ancilla in a state which is the sum of all even parity states. Such 
a state can be made by preparing a "cat" state |0 . . . 0) + |1 . . . 1) (named after 
Schrodinger's cat) and performing a Hadamard transform (4.12) on each qubit. 
Again, we perform a CNOT from the data qubits to corresponding qubits in 
the ancilla and measure the ancilla. The result will have even parity iff the 
selected data qubits have even parity, but the measurement does not destroy 
superpositions of the possible data states with that parity. Again, a single error 
in the ancilla could give the wrong parity, so we should repeat the measurement. 
Also, the preparation of the "cat" state is not at all fault-tolerant, so we could 
easily have multiple bit flip errors in the "cat" state, which will result in multiple 
phase errors in the ancilla state. Since phase errors will feed back into the data, 
we should carefully verify the "cat" state to make sure that we do not have 
multiple amplitude errors. 

Suppose we want to measure a more general operator in Q, such as M\ = 
<?x <8> c z (g) a z (g) a x (g) /, the first generator for the five-qubit code. Note that 
under the Hadamard transform 



|0) <-> |0) + |1) 

|1) <-> |0)-|1), (5.3) 

so the eigenvectors of a z transform to the eigenvectors of a x and vice-versa. 
This means to measure Mi, we should perform the Hadamard transform on 
qubits one and four and instead measure <j z ® a z ® a z ® a z <g /. We know how 
to do this from the above discussion. Then we should perform the Hadamard 
transform again to return to the original state (modulo any collapse caused by 



CHAPTER 5. FAULT-TOLERANT COMPUTATION 



40 



the measurement). In a similar way, we can rotate a y into a z (exactly how is 
discussed in more detail in section 5.3), and therefore measure any operator in 
Q. 

From the ability to make measurements, we can easily perform error cor- 
rection for any stabilizer code |59|. Recall that to correct errors, we measure 
the eigenvalue of each generator of the stabilizer. This we now know how to do 
fault-tolerantly. This tells us the error syndrome, which tells us the error (or 
class of degenerate errors). This error is some operator in Q, and to correct it, 
we just apply the operator to the code. Since it is the tensor product of single 
qubit operators, this is a transversal operation, and is therefore fault-tolerant. 

Because a full measurement of the error syndrome takes a fair amount of 
time, the possibility of an error in the data while measuring the syndrome can- 
not be ignored. An error in the data in the middle of the syndrome measurement 
will result in the wrong syndrome, which could correspond to a totally differ- 
ent error with nothing in common with the actual error. Therefore, we should 
measure the syndrome multiple times, only stopping when we have sufficient 
confidence that we have determined the correct current error syndrome. Since 
we are measuring the syndrome multiple times, we only need to measure each bit 
once per overall syndrome measurement; repetitions of the syndrome measure- 
ment will also protect against individual errors in the syndrome bits. The true 
error syndrome will evolve over the course of repeated measurements. Eventu- 
ally, more errors will build up in the data than can be corrected by the code, 
producing a real error in the data. Assuming the basic error rate is low enough, 
this occurance will be very rare, and we can do many error correction cycles 
before it happens. However, eventually the computation will fail. In chapter]^, I 
will show how to avoid this result and do arbitrarily long computations provided 
the basic error rate is sufficiently low. 



5.3 Transformations of the Stabilizer 

Now I will begin to discuss how to perform actual operations on encoded states. 
We already know how to perform encoded a x , a yi and a z operations on stabilizer 
codes. These operations all commute with the stabilizer and therefore leave the 
generators of the stabilizer alone. A more general unitary operation U will not 
necessarily do this. If M € S, then = M\ijj) for 6 T, and 

U\ip) = UM\tp) = UMU f U\ip), (5.4) 

so UMW fixes U\iji). Even if we have an operator N which is not in S, U will 
take the eigenvectors of N to eigenvectors of UNU>, effectively transforming 
TV — > UNU^ . Suppose UMW € Q. Then if we want an operation that takes 
an encoded codeword to another valid codeword, we need UMW € S. If this is 
true for all M € S, then U\ip) € T as well, and U is a valid encoded operation. 
If it is also transversal, we know it will be fault-tolerant as well. 

The set of U such that UAW € Q for all A € Q is the normalizer N{Q) of Q 
in U(n). It turns out that N(Q) is generated by the single qubit operations R 
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(the Hadamard transform) and 

'-(;;)■ M 

and the controlled NOT Q The set of U such that UMW £ S for all 
M G S is the normalizer Nur n \(S) of 5 in U(n), which need not be a subset of 
N(Q). Any transversal operator in Njj^(S) is a valid fault-tolerant operation. 
However, operators outside of N(Q) are much more difficult to work with and 
analyze. Therefore, I will restrict my attention to operators in the intersection 
of N(G) and N u(n )(S). 

The operators in N(Q) acting on Q by conjugation permute tensor products 
of o x i &y, and a z . For instance, 

-*G -00 ;)0 -•)-(; -')- - (5 - 6) 

-")(! _\)-(; ;)- - m 

Also, 

R<TyR) — —iRo x o Z R) = —iRcfxR^RazR^ — —icr z a x — —cr y . (5-8) 
iZ switches cr^ and er 2 . Similarly, 

p^-p' =u :nr ;,nj _°) = (" "„)= *» t^) 
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P switches a x and a y . These two operations generate all possible permutations 
of a x , a y , and a z . Operators in N(Q±) can be viewed as transformations of the 
Bloch sphere which permute the coordinate axes. 

The third generator of N(Q) is the controlled NOT. It acts on two qubits, 
and therefore permutes the elements of Q 2 - Its action is as follows: 

a x ® I — > a x ® a x 

I(g>a x -> I®a x (5-11) 

a z ® I — > <j z ® I 

I (g) cr. — > cr z ® cr z . 



Amplitudes are copied forwards and phases are copied backwards, as I described 
before. In the same way, any element of N(Q) gives a permutation of £/. These 
permutations of Q always preserve the group structure of G, so are actually 
automorphisms of Q. 

Given an automorphism of Q, we can always find an element of N(Q) that 
produces that automorphism [^o| , modulo the automorphism il — > —il. We 
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Figure 5.1: Network to swap |a) and \j3) using ancilla I7). 



can find the matrix of a given transformation U corresponding to some auto- 
morphism by determining the action of U on basis states. |0) is an eigenvector 
of cr z , so it is mapped to an eigenvector of Ua z W . |1) = o" x |0), so it becomes 
(Ua x U')U\0) . For instance, the automorphism T : a x — > a y , <r z — > <r x maps 
|0) -> (l/\/2)(|0) + |1)) and |1) a a T|0) = -(i/V2) (|0) - |1)). Thus, the 
matrix of T is 

V2 U * 



(5.12) 



Another useful operation is to swap two qubits in a block. This is not a 
transversal operation, and it is not fault-tolerant by itself. An error during 
the swap gate can produce errors in the two qubits to be swapped, producing 
two errors in the same block. However, we do not need to worry about error 
propagation because the swap gate swaps the errors along with the correct 
states. Therefore, to get a fault-tolerant swap gate, we only need to produce 
a circuit to swap qubits that does not directly interact them. Such a circuit is 



given in figure 5.1 



In order to produce a valid fault-tolerant encoded operation, we may com- 
bine swap operations within a block of an error-correcting code and transversal 
operations on the block to get something that permutes the elements of the 
stabilizer. The set of such operations is the automorphism group A(S) of S. 
Codes with a large automorphism group are therefore better suited for perform- 
ing fault-tolerant operations. For instance, the seven-qubit code of table [O] is 
invariant under any single-qubit operation in N(Q) performed bitwise. There 
are also a number of permutations of its qubits in the automorphism group, 
although they turn out to be unimportant in this case. The five-qubit code 



of table 3.2 has fewer automorphisms. The only transversal operations in its 



automorphism group are 



(5.13) 



and T 2 . Note that in the language of GF(4) codes, the operation T corresponds 
to multiplication by lu 2 . Therefore it is a valid transversal operation for any 
linear quantum code. The five-qubit code is also invariant under cyclic per- 
mutations of the five component qubits, although these operations turn out to 
leave the encoded data unchanged, so are not very useful. 
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Once we have a possible encoded operation U, we must discover what it 
actually does to the encoded states. We can do this by analyzing the behavior 
of N(S)/S under the operation. Because U is in N(Q) n Nur n \(S), it also has 
a natural action on N(S)/S = Qk- This action on Qk is equivalent to some 
operation in N(Qk). This is the operation that is performed on the k encoded 
qubits. For instance, the Hadamard transform R applied bitwise to the seven- 
qubit code switches X = a X 5(J X 6(J X 7 and Z = a z ^a z §o Z 7 ■ This is just R applied 
to the Gi group for the single encoded qubit. In the same way, P bitwise for 
the seven-qubit code converts X into —Y (Y is the encoded a y ), and thus 
performs an encoded ft. The minus sign for Y occurs because Y = —iXZ = 
—i{i 3 )ay5a y ea y 7 = —o y $o y §Otfi_- 

For the five-qubit code, o x\Oxio x %o x iO x § and Z = o zl a Z 2a z za z ^a z ^, 

so T bitwise transforms X to Y and Z to X, and therefore acts as an encoded 
T operation. For both the five- and seven-qubit codes, the qubit permutations 
in A(S) produce the identity operation on the encoded qubits. For a block 
encoding k qubits, an operation in the automorphism group might perform any 
multiple-qubit operation in N(Gk)- 

We can also do multiple-qubit operations interacting two blocks by applying 
multiple-qubit operations transversally between the blocks. For instance, we 
can apply a CNOT from the ith qubit in the first block to the ith qubit in the 
second block. We can interact r blocks by applying transversally any operation 
in N(Q r ). We can even apply different operations to different qubits within a 
block. However, we should not also apply swaps within a block unless we can 
perform error correction afterwards, since otherwise errors could spread from 
one qubit in a block to the corresponding qubit in a different block, then back 
to a different qubit in the first block, producing two errors in the first block. 

The stabilizer of two blocks of a code is just S x S. Therefore, the operation, 
to be valid, must permute the elements of this group. For instance, bitwise 
CNOT applied between two blocks of the seven-qubit code is a valid operation, 
because 

Mi® I -» Mi® Mi (i = 1,2,3) 

Mi® I -» Mi® I (i = 4,5,6) (5.14) 
I® Mi -> I® Mi (i = 1,2,3) 
I® Mi -> Mi ® Mi (i = 4,5,6). 

Since this also takes 

X®I -> X®X 

I®X -» I®X (5.15) 
Z®I -» Z®I 

I®~Z -» z®z, 



it acts as a CNOT on the encoded qubits. On the other hand, bitwise CNOT 
applied to the five-qubit code is not a valid operation, because, for instance, 
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Mi = <j x ® cr z ® ct 2 (8) <r x ® J, so Mi <g> 7 -> Mi ® (<r x ® I ® I ® a x ® I) and 
<r x I ® 7 ® a x ® 7 is not in S. 

The CSS codes are those for which the stabilizer is the direct product of 
a part where the elements are tensor products of cr^'s and a part where the 
elements are tensor products of cr^'s. We can also pick the X and Z operators 
to be tensor products of C7 x ,'s and a z i's, respectively. This means that just as 
with the seven-qubit code, bitwise CNOT will be a valid operation for any CSS 
codes, and will perform the CNOT between corresponding encoded qubits in 
the two blocks. 

Conversely, if bitwise CNOT is a valid operation for a code, that means it is 
a CSS code: Let M = XY be an arbitrary clement of the stabilizer S, where X 
is the tensor product of cr^'s and Z is the tensor product of a z i's. Then, under 
CNOT, M ® I -> M ® X and 7 ® M -> Z ® M. Thus, X and Z arc themselves 
elements of S. The stabilizer therefore breaks up into a a x part and a a z part, 
which means it is a CSS code. 

5.4 The Effects of Measurements 

We are not strictly limited to unitary operations in a quantum computation. 
We can also make measurements, which correspond to randomly applying one 
of a set of complete projection operators, usually labeled by eigenvalues of a 
Hermitian operator. Based on the classical measurement result, we can then 
apply one of a number of possible operators to the resulting quantum state. 
This process can be converted into a purely quantum process, but in the ideal- 
ization where classical computation is error-free while quantum computation is 
not, there is a distinct advantage in converting as much as possible to classical 
information. Even in a more realistic situation, classical computation is likely to 
be much more reliable than quantum computation and classical error-correction 
methods are simpler than quantum ones. In addition, we may know how to per- 
form operations conditioned on classical information fault-tolerantly even when 
we do not know how to perform the corresponding quantum operations fault- 
tolerantly. As we shall see, ancilla preparation and measurement are powerful 
tools for expanding the available set of fault-tolerant quantum operations. 

Suppose we wish to measure operator A, with A 2 = I. Measuring A for a 
state \ip) will typically give one of two results \ip+) or \ip~), corresponding to 
the two eigenvalues ±1 of A. In order to keep the description of our algorithm 
under control, we would like a way to convert \ip-} to \ip + ) for any possible 
input state This will not be possible unless we know something more about 
the possible states \ip). Suppose we know that there is a unitary operator M, 
with M\tp) = |V>) and {M, A} = 0. Then 

M f |^_) = M f i(7- A)\tp) = M^{I - A)M\^) 

= M^M^(I + AM = ^(I + Am (5.16) 

= IV>+>- 
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If we make the measurement, then apply Aft if the result is —1 and do nothing 
if the result is +1, then we have applied the nonunitary operator P + — h(I+A). 
We can then continue the computation with the assurance that the computer is 
in the state \ip+). In order to perform this nonunitary operator, we have taken 
advantage of the fact that \ifj) is a +l-eigenstate of Af . This trick cannot be 
used if we do not know anything about the state of \ip). 

We know how to measure operators in Q fault-tolerantly. If we prepare 
an ancilla in a known state and apply a known set of operations in N(Q), 
the resulting state can be at least partially described by a stabilizer S. This 
stabilizer is not the stabilizer of a quantum error-correcting code, but simply 
a way of describing the information we have about the state. In many of the 
applications below, there will be one stabilizer for the error-correcting code, and 
another which describes the restricted state of the data due to our preparation 
of the ancilla in a known state. We can fault-tolerantly measure (fault-tolerant 
with respect to the error-correcting code) an operator A £ Q that anticommutcs 
with some Af € S (the stabilizer describing the data) and correct the result as 
above to perform the operation P + . Any operators in S that commute with 
A will still fix the state of the system after the measurement and correction. 
Hereafter, in the context of performing operations on encoded states, I will 
usually speak of "measuring" A when I mean applying P + for A. 

If A € S, there is no need to measure A to perform P + , since the state is 
already an eigenstate of A with eigenvalue +1. If A commutes with everything 
in S but is not in S itself, then measuring A will give us information about 
which state we had that was fixed by S. However, we do not have an Af that 
anticommutes with A, so we cannot fix P_ to P+. If A anticommutes with some 
element of S, say Afi, then we can choose the remaining n — k — 1 generators 
of S to commute with A (if Afj anticommutes with A, Mi Mi will commute 
with A). The stabilizer S' after applying P + will then be generated by A and 
M 2 ,...,M„_ fe . 

We can better understand the operator P + by looking at the transformation 
it induces from N(S) / S to N(S') / S' . Half of the representatives of each coset in 
N(S)/S will commute with A and half will anticommute, since of ./V and MiN, 
one will commute and one will anticommute. If N E N(S) commutes with A, its 
eigenvectors and eigenvalues are left unchanged by measuring A. Therefore the 
coset represented by N in N(S')/S' will act on P+\4>) in the same way as the 
coset in N{S)/S acted on \ip). Any representative of the same coset in N(S)/S 
will produce the same coset in N(S')/S' as long as it commutes with A. We 
therefore have a map from N(S)/S = Q to N(S')/S' = G, which is an operation 
in N(Q). Using selected ancilla preparation and existing tranversal operations, 
we can use this process to create new transversal operations. 

A nice example of this formalism, which can be applied independently of 
quantum error correction, is a description of quantum teleportation |4l). We 
start with three qubits, the first in an arbitrary state \ip), the other two in the 
Bell state |00) + |11). This state can be described by the stabilizer Si generated 
by I ® a x ® a x and I <g> a z % a z . The cosets of N{S\)jS\ can be represented by 
X = a x I <8 I and Z = a z ® I ® I. The third qubit is far away, so we cannot 
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perform any quantum gates interacting it with the other two qubits. However, 
we can make measurements on the first two qubits and send the information to 
be used to perform conditional quantum gates just on the third qubit. 

First, we apply a CNOT from the first qubit to the second qubit. This 
produces stabilizer 52 generated by I ® a x ® a x and a z <£> a z <E> <J Z , with X = 
cr x ®cr x ®I and Z = a z ®I®I. Now measure o x for the first qubit. This produces 
stabilizer S3 generated by u x £g> J <g> I and I ® a x ® u x . The coset representative 
<r x ®a x ®I commutes with the measured operator, so it still represents the new 
coset. Multiplying by the first generator of S3 still gives a coset representative 
of X in N(Ss)/S3, so X = I ® u x ® I. a z ® I ® / does not commute with the 
measured operator, but (a z ® a z ® a z )(a z ® I ® I) = I ®a z ® a z represents the 
same coset in N^S^jSi and does commute with the measured operator, so it 
represents the Z coset in N{S-i)i 'S3. The measurement potentially requires an 
application of a z ® <r z ® a z if it is necessary to correct P_ . This provides one of 
the sets of conditional operations used in quantum teleportation. 

Now we measure a z for the second qubit. This produces the stabilizer £4 
generated by a x ® / ® I and I ® a z ® I. This time, the representative of 
Z commutes with the measured operator, so Z for TV^)/^ is I ® a z ® a z = 
I®I®a z . I®a x ®I does not commute, but (I®a x ®cr x )(I®a x ®I) = I®I®a x 
does, so in A^Sy/S^, X = I ® / ® a x . The operation to correct P_ this 
time is I ® a x ® a x . This provides the second set of conditional operations in 
teleportation. 

Note that S4 completely determines the state of the first two qubits and 
does not restrict the state of the third qubit at all. In fact, the X operator in 
N(Si)/ Si, which started as a x for the first qubit, has been transformed into a x 
for the third qubit, and Z, which began as a z for the first qubit, has become a z 
for the third qubit. This means the final state is (|0) + |1)) <g> |0) ® and we 
have teleported the state as desired. 

After we measure a Xl a y , or a z for a qubit, we have completely determined 
the state of that qubit, so its contribution to the stabilizer will just be the 
operator just measured, and it will not contribute to standard representatives 
of the cosets in N(S')/S' at all. Therefore, when describing how to produce 
new transversal operations, I will drop qubits from the notation after they have 
been measured. 

5.5 Producing New Operations in N(Q) 

The group N(Q) can be generated by just the operations R, P, and CNOT 
applied to arbitrary qubits and pairs of qubits. I will now show that, by us- 
ing measurements, we can, in fact, generate N(G) using just CNOT. Then I 
will demonstrate that for most known codes, we can apply an encoded CNOT 
transversally. 

First, note that by preparing an ancilla in an arbitrary state and measuring 
a x , a yi or a z , we can always prepare that ancilla qubit in the +1 cigenstate of 
any of these three operators. Also, there are only six interesting operators in 
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7V(£i): I, R, P (and pt) j Q ( an d Qt) ; T, and T 2 (and Tt and (T 2 )t), where 
Q = P^RP switches a y and er^, and T = RP^ is the cyclic permutation of a x , 
<jy, and a z . I have only counted this as six operators, since the adjoints produce 
the same permutations, but with different signs distributed among a Xl a y , and 
a z . This effect can also be produced by applying a Xl a y and a z themselves. 
Any two non-identity operators in this set, other than T and T 2 , will suffice to 
generate all of them. 

Suppose we have an arbitrary single-qubit state \ip). Let us prepare an ancilla 
qubit in the +1 cigenstatc of a z , then apply a CNOT from the data qubit to 
the ancilla qubit. This produces the stabilizer a z <g> a Zl with X = a x ® <J X and 
Z = <7 Z <g) I. Now measure a y for the ancilla qubit and discard the ancilla. This 
leaves the first qubit with X = —a v and Z = a z , which means we have applied 
Pt. 

Now prepare the ancilla in the +1 cigenstatc of a x and apply a CNOT from 
the ancilla qubit to the data qubit. This produces stabilizer a x <g> <r x , with 
X = a x <g> I and Z = <j z <g> a z . Measure a y for the ancilla and discard it, leaving 
X = a x and Z = —o y - We have applied 0} . Along with P from above, this 
suffices to generate N(Q\) and therefore N(Q n ) for any n. 

We can also produce T directly by preparing the ancilla in the +1 cigenstatc 
of o y and applying a CNOT from the ancilla qubit to the data qubit. This 
produces a stabilizer of a x ® <r y , with X — a x ® I and Z — a z <£> o z . Measure 
a y for the data qubit and discard it, leaving X = a y and Z = a x , both on the 
former ancilla qubit. The net result is to apply T, but to move the data from 
the data qubit to what began as the ancilla qubit. 

Now let us turn our attention to transversal operations on quantum error- 
correcting stabilizer codes. Consider the following four-qubit transformation: 

a x ® I ® I ® I — > g x ® <j x <£> <7 X <£> I 

I <£> o x ® I ® I — » / ® a x <£> a x ® a x 

I ® I ® <j x ® I — * cr x ® I ® a x ® a x 

/®7®7®C7 X — ► u x ® a x ® I ® C7 X (5-17) 

a z ® I ® I ® I — » a z ® a z ® a z ® I 

I®a z ®I®I — > / ® (Tx ® C7 2 ® cr 2 

I ® I ® cr z ® I — > a z ® I ® a z ® cr z 
I ® 7 ® 7 <g> C7 2 — > cr z (Xicr z (g)7(Kicr z . 

Given an element M of an arbitrary stabilizer, this operation applied bitwise 
maps 

M®7®7®7 -> M ® M ® M ® I 

I ® M ®7 ® 7 -» I ® M ® M ® M (5.18) 

7®7®M®7 -> M ® I ® M ® M 

I ® 7 (g) 7 ® M -» M ® M ® 7 <g> M. 



Each of these images is in the group 5 x S x 5 x 5, so this is a valid transversal 
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operation for any stabilizer code. Because of ( |5.18 ), this operation just applies 



itself to the encoded qubits. When the code has multiple qubits per block, (5.17) 
applies itself to all of the corresponding sets of encoded qubits. 

This is very useful, since if we have two logical qubits and prepare two more 



ancilla logical qubits each in the +1 eigenstate of a z , and then apply (5.17) 
to these four qubits, we get a stabilizer with generators a z ® / <£> a z ® a z and 
a z ® o z ® / ® o z , and 

X\ = <T X ® <7 X ® (J x ® I 

X 2 = I®a x ®a x ®a x (5.19) 

Z\ = (T Z ®(T Z ®(J Z ®I 

Z 2 = I ® a z ® a z ® a z . 
Measure a x for both ancilla qubits and discard them. This leaves us with 

X\ = cr x (g) a x 

X2 = I®o x (5.20) 
~Zi = a z (g>I 
Z2 = a z (g>a z . 

This we can recognize as the CNOT from the first data qubit to the second data 
qubit. As the CNOT suffices to get every operation in N(Q), we can therefore 
perform any such operation transversally for any stabilizer code encoding a 
single qubit. 



There are other operations like (5.17) that work for any stabilizer code. The 



condition they must satisfy |35| is for a x tensor any number of copies of the 
identity to map to the tensor product of some number of copies of a x and /, 
and a z in the same position must map to the same tensor product of a z and /. 
This means any such automorphism can be fully described by annxn binary 
matrix (for an n-qubit operation). The image of a X i must commute with the 
image of a Z j for i ^ j. This means that the binary dot product of two different 
rows of the matrix must be 0. Also, the image of a X i must anticommute with 
the image of a Z i. This means that the binary dot product of any row with itself 
must be 1. These two conditions combine to say that the matrix must be an 
element of 0(n, Z2), the orthogonal group over Z2. The smallest n for which 
this group has an element other than a permutation is n = 4. If we were working 
with d-dimensional states instead of qubits, we would instead need a matrix in 
0(n, Z<j). Note that the straightforward generalization of ( |5.1g| ) is in 0(n, Z^) 
for n = d + 2. 

Codes which have single-qubit tranversal operations other than the identity 
will in general have a larger available space of multiple-qubit operations. Any 
n-qubit automorphism that maps a x to the tensor product of J with Ui(a x ) and 
a z to the same tensor product of I with Ui(a z ) will be an automorphism of n 
copies of S if Ui is an automorphism of S for all i. Note that Ui may be the 
identity. It may also be possible for Ui to not be an automorphism of Q\ at all, 
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although this will depend on the code. For instance, for a CSS code, we can 
have Ui(a x ) = a x , Ui{a z ) = I or Ui{a x ) = I, Ui(a z ) = a z . 

5.6 Codes With Multiple Encoded Qubits 

For codes encoding more than one q ubit per block, we have more work to do. 
We only know how to perform ( |5.17 ) between corresponding qubits in different 



blocks, and furthermore, we must perform the operation between all the encoded 
qubits in both blocks. 

The solution to the second problem is straightforward. If we prepare an 
ancilla qubit in the +1 eigenstate of a x and apply a CNOT from the ancilla 
to a single data qubit, we get the stabilizer a x ® a Xl with X = a x ® I and 
Z = <j z ® a z . Then if we measure u z for the data qubit, we are left with X = a x 
and Z = <j z , both for the ancilla qubit. We have transferred the data qubit to 
the ancilla qubit without changing it. On the other hand, if we had prepared 
the ancilla qubit in the +1 eigenstate of a z and applied the CNOT, nothing in 
the data qubit would have changed. 

We can use this fact to switch individual encoded qubits out of a storage 
block into a temporary holding block. Prepare the holding block with all the 
encoded qubits in the +1 eigenstate of a z , except the jth encoded qubit, which 



is in the +1 eigenstate of a x . Then use (5.17) to apply a CNOT from the 
holding block to the storage block and measure a z for the jth encoded qubit 
in the storage block. This switches the jth encoded qubit from the storage 
block to the holding block while leaving the other qubits in the storage block 
undisturbed. The jth encoded qubit in the storage block is left in the state |0), 
as are all the encoded qubits in the holding block but the jth one. 

To perform operations between just the jth encoded qubits in two (or more) 
different blocks while leaving the other qubits in those blocks alone, we can 
switch both jth qubits into new, empty blocks, as above. Then we interact them. 
If necessary, we again clear all but the jth encoded qubit in each temporary block 
by measuring a z . Then we can switch the qubits back into the initial blocks by 
applying a CNOT from the holding block to the appropriate storage block and 
measuring Xj for the holding block. 

This leaves the questions of interacting the jth encoded qubit in one block 
with the ith encoded qubit in another block, and of interacting two encoded 
qubits in the same block. We can partially solve either problem by switching 
the two qubits to be interacted into separate holding blocks. If we know how to 
swap the jth encoded qubit with the first encoded qubit, we can then swap both 
qubits into the first position, interact them as desired, then swap them back to 
their initial positions and switch them back to their storage block or blocks. 

One way to swap qubits within a block is to perform some nontrivial action 
on a single block. For a code with trivial automorphism group, this will not 
exist. However, almost any automorphism will suffice to swap encoded qubits 
as desired. This is because there are so few two-qubit operations in N(Q). Any 
automorphism of the code will produce some element of N(Gk) on the k encoded 



CHAPTER 5. FAULT-TOLERANT COMPUTATION 



50 



qubits, typically (although certainly not always) interacting all of them. If we 
perform some measurement on all of the encoded qubits in the block except 
the first and the jth, we are left with a two-qubit operation between those two 
encoded qubits. 

We can always perform singlc-qubit operations on any encoded qubit in a 
block by switching the qubit into a fresh block, applying the operation to every 
encoded qubit in the new block, clearing unneccesary qubits and switching the 
qubit back to the first block. Using this freedom, any operation in N{Q2) can 
be transformed to map u x <g> I to one of a x <g> J, a x <g> a x , and I <g> o x . There 
is still a remaining freedom to switch a y and a z on either qubit, and we may 
also switch either with a x for any qubit where the image of a x ® I acts as the 
identity. We treat the three possibilities as separate cases: 

• a x ® I — > a x <g> I 

The operation preserves the group structure of Q2, so the image of 7® a x 
must commute with a x ®I. Up to single-qubit operations, the possibilities 
are 



1. I ® a x : The image of a z ® I must be either a z ® I or a z ® a x . In 
the first case, the image of I <£> a z is I ® a z and the operation is the 
identity. In the second case, the image of I ® a z must be a x ® a z . If 
we apply R to the first qubit before the operation and again after it, 
this produces a CNOT from the first qubit to the second qubit. 

2. g x ® a x : The image of o z <£> I must be cr z ® cr z and the image of 
I ® a z may be either I ® o z ox u x ® u y . If it is I (g> a z , the operation 
is exactly CNOT from the second qubit to the first. If it is a x ® a y , 
we can again get CNOT from the second qubit to the first by simply 
applying Q to the second qubit, followed by the operation. 

• a x ® I — > I ® a x 

This case is related to the first one by simply swapping the two qubits. 
Therefore, the possibilities can be reduced to a simple swap, and a CNOT 
either way followed by a swap. 

• a x ® I — > <j x ® a x 

Now there are three possibilities for the image of I ® a x : I ® a x again, 
a x ® I, or a z ®a z . 

1. I ® <j x : The image of I <g> o z must be a z ® o z . The image of a z ® I 
may be either a z ® I or a y ® a x . As with case two above, if it is 
a z ® I, this is a CNOT from the first qubit to the second; if it is 
<T y (g)a x , we can apply Q to the first qubit and then this operation to 
get a CNOT from the first qubit to the second. 

2. <t x ®T. This case can be produced from the previous one by swapping 
the two qubits. Thus, the operation can be converted into a CNOT 
from the first qubit to the second followed by a swap. 
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Figure 5.2: Network to swap two qubits using CNOT. 

3. a z ® <t z : In this case, the image of a z ® / can be a z ® I, I ® <y z , 
a y ®<7 x , or a x ® (T y . If the image of cr z ® I is er z ® /, the image of 
I ® a z must he I ® a x or cr z (g> cr y . If it is / <8> cr^ and we apply R to 
the second qubit and then this operation, it performs a CNOT from 
the first qubit to the second. If it is a z ® a y , we can apply Ta z to 
the second qubit, followed by the operation in order to get a CNOT 
from the first qubit to the second. If the image of a z <S> I is / <8> a z , we 
can get it from last case by swapping the qubits, so it can be reduced 
to a CNOT from the first qubit to the second followed by a swap. 
If the image of a z ® 1 is a y <£> a x , then the image of 1 cr z may again 
be either I ® <r x or a z <£> a y . If it is / (g> cr^ , we can perform Q on 
the first qubit and R on the second qubit, followed by the two-qubit 
operation. This produces a CNOT from the first qubit to the second 
one. If it is a z <S> a y , we can perform Q on the first qubit and Ta z 
on the second qubit, followed by the two-qubit operation. This again 
produces a CNOT from the first qubit to the second qubit. 
Finally, if the image of a z ® I is a x ®a yi we can produce the previous 
case by applying a swap, so the two-qubit operation can be converted 
to a CNOT from the first qubit to the second qubit followed by a 
swap. 

Also, note that R applied to both qubits, followed by a CNOT in one direc- 
tion, followed by R on both qubits, produces a CNOT in the other direction. 
Therefore, up to application of single-qubit operations, the only possible two- 
qubit operations in N(Q) are the identity, a CNOT, a swap, or a CNOT followed 
by a swap. We can make a swap out of three CNOTs using the simple network 



from figure 5.2 



We cannot make a general swap out of CNOT followed by swap. However, if 
the control qubit of the CNOT begins in the state |0), the operation does swap 
the two qubits. This is all that is necessary to get all of N(Q), since we only 
need to move a single data qubit around within an otherwise empty block. 

Even if we have no automorphism to switch the jth qubit and the first qubit, 
we can still do it using quantum teleportation pi] . To do this, we will need an 
EPR pair entangled between the first and jth encoded qubits. We can make 
an unencoded EPR pair and then encode it normally. However, a single error 
during the encoding can destroy the pair. Therefore, we will need to make a 
number of EPR pairs and purify good ones using an entanglement purification 
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protocol (EPP) (jlT], |42|. We can interact corresponding qubits in the EPR pair 
using operations in N(Q), which is all that is necessary. For instance, we could 
make five EPR pairs and use the one-way EPP derived from the five-qubit code 
to purify a single good EPR pair. It would take two independent errors to get 
an error in this pair. An easier way to make the EPR pair is to start with the 
+1 eigenstate of both Z\ and Zj, then to measure X\Xj, which is an operator 
in N(S) just like any other. This leaves the ancilla block in the +1 eigenstate 
of Z\Zj and X\Xj, which is just an EPR pair. 

Once we have a reliable EPR pair, the teleportation process requires only 
operations in N(Q) between corresponding encoded qubits. This allows us to 
move the jth encoded qubit in one otherwise empty block to the first encoded 
qubit in the block that previously held the EPR pair. This allows us to do any 
operation in N(Q) for any stabilizer code. Essentially the same procedures will 
work when the basic unit is the qudit instead of the qubit fi3f . 

5.7 The Toffoli Gate 

The group N(Q) is insufficient to allow universal quantum computation. In fact, 
Knill phi has shown that a quantum computer using only elements from N(Q) 
and measurements can be simulated efficiently on a classical computer. The 
argument follows easily from the results of the preceding sections. If we begin 
with a state initialized to |0 • • • 0), the stabilizer is a z \, a z2 , . . .. Each operation 
in N(Q) produces a well-defined transformation of the stabilizer, which can be 
classically tracked efficiently. Any measurement will also transform the stabilizer 
in a well-defined way, which is again easy to keep track of on a classical computer. 
Therefore, we can store and evolve complete information on the state of the 
quantum computer with only polynomial classical overhead. 

In order to perform truly universal quantum computation, even a single gate 
outside of N(Q) can be sufficient. For instance, the Toffoli gate (a three-qubit 
gate which flips the third qubit iff both of the first two qubits are |1)) along with 
N(G) suffices for universal computation. Shor gave an implementation of the 
Toffoli gate |3£| which can be easily adapted to any code allowing N(Q). Since 
this is any stabilizer code, we can do universal computation for any stabilizer 
code. Note that there are a number of other gates outside N(Q) that we could 
add to get a universal set of gates (such as the single-qubit n/8 rotation), and 
for some codes, it may be easier to perform these gates than the Toffoli gate 
JIB] . However, I will just discuss the implementation of the Toffoli gate. 

The Toffoli gate can be expanded using Q as a basis as follows: 

- (3/ + <r zl + a z2 - (t z1 (t z2 + (I - a zl )(I - <r z2 )a x3 ) . (5.21) 

Applying the Toffoli gate to a state therefore produces the following transfor- 
mation on the elements of Q 3 : 

C X 1 — > ~- {31 + CT z i + <T Z 2 — <J Z 1<T Z 2 + (I - &zl)(I — &z2)&x3) 
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x 



(3/ — cr z i + a z2 + <J z x<J z2 + {I + cr z i)(7 — cr z2 )cr K 3) ct x i 



= 7^{I + <?z2 + {I - Vz2)crx3)<7xl 

&x2 — ► ^ ^ + ^ + _ ^l) "^) 0"a2 

Cz3 — > CTs3 (5.22) 

Czl — > cr z i 

CTz2 — > CT Z 2 

CT z3 -> 77 (3/ + cr z i + cr z2 - <T Z1 (T Z 2 + (I - <T zl )(I - <J z2 )(T x3 ) 

16 

x (3I + a zl + a z2 -<J z i<r z2 - (I - <t z i)(I - a z2 )a x3 ) a z3 
= -(I + <r z i + (I - a z i)a z2 )<J z3 . 

This means a z \, a z2 , and a x3 stay the same, a x \ becomes u x \ tensor a CNOT 
from qubit two to qubit three, a x2 becomes a x2 tensor a CNOT from qubit one 
to qubit three, and a z3 becomes a z3 tensor a conditional sign for qubits one and 
two. 

Suppose we can make the ancilla 

1-4) = 7^(|000> + |010) + |100> + |111». (5.23) 
This state is fixed by the three operators 

Ml = i (I + <7 z2 + (I - <T z2 )<T x3 ) <7 xl 

M 2 = i (I + a z i + (I -a zl )a x3 ) a x2 (5.24) 

M 3 = i (I + a zX + (I - a zl )a z2 ) a z3 . 

Now suppose we have three data qubits (numbers four, five, and six) that we 
wish to perform a Toffoli gate on. We simply apply CNOTs from qubit one 
to qubit four, qubit two to qubit five, and from qubit six to qubit three. This 
produces the following "stabilizer" : 

M[ = ^(I + cr z 2 + {I-cr z 2)cr x3 )cr x icr x 4, 

M' 2 = ~(I + a z i + (I-cr z i)cr x3 )cr x 2crx5 (5.25) 

M 3 = i (I + <7 zl + (I - a zl )(T z2 ) a z3 a z6 . 

Then measure tr 2 4, 0^5, and a X Q and discard qubits 4-6. As we can see, this 
produces the transformation (5.22) on the three data qubits while moving them 
to what were formerly the ancilla qubits. Note that correcting for measured 
eigenvalues of —1 will require applying Mi, M 2 , or M 3 , which are not elements 
of Q. They are, however, elements of N(Q). 
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Therefore, in order to perform the Toffoli gate on encoded states, we must 
produce an encoded version of the ancilla \A). Then we need only perform 
measurements and encoded operations in N(Q) to produce the effect of a Toffoli 
gate. Below, I will assume Q only encoded one qubit per block. If it encodes 
more, we can still do the same thing by moving the qubits to be interacted into 
the first encoded qubit in otherwise empty blocks. The X and Z operators used 
to create the ancilla are just X\ and Z\. 

To produce the encoded ancilla |^4), we start with the encoded version of 
the state \A) + \B), where 



|B) = i(|001> + |011) + |101) + |110>). 



(5.26) 



Note that \B) is related to \A) by applying a x to the third qubit. Since 



in 

£ 

a=000 



|1» 3 , 



(5.27) 



we can easily prepare it by measuring X for each block. Henceforth, \A) and 
\B) will denote the encoded versions of themselves. Now we take an ancilla in 
a "cat" state |0 . . . 0) + |1 . . . 1), where the number of qubits in the cat state 
is equal to the number of qubits in a single block of the code. Then we will 
perform an operation that takes 



0. 


■0)1 A) 


- |o. 


•0)1 A) 


1. 


.1)1 A) - 




.1)1 A) 


0. 


.0)|2?) 


- |o. 


.0)|5) 


1 . 


.1)\B) - 


- -11. 


..1)\B) 



(5.28) 



Then under fl5.28| ), 

(|0...0) + |1...1))(|A) + |B))-,(|0...0) + |1...1))|A) + (|0...0)-|1...1))|B). 

(5.29) 

If we measure cr x ® • • ■ <S> cr x for the cat state, if we get +1, the rest of the ancilla 
is in the state \A). If we get — 1, the rest of the ancilla is in the state \B). 
One complication is that a single qubit error in the cat state can cause this 
measurement result to be wrong. Luckily 



(|0...0) + |1...1))L4) - (|0...0) + |1 
(|0...0) + |1...1))|B) - (|0...0)-|1 



MA) 
MB). 



(5.30) 
(5.31) 



Therefore, if we prepare another cat state and apply ( [5. 28] ) again, we should 
again get +1 if the ancilla was actually in the state \A) after the first mea- 
surement and —1 if it was actually in the state \B). We can therefore get any 
desired level of reliability for the ancilla state by repeating ( |5.28| ) a number of 
times. Finally, once we are confident we have either \A) or \B), we apply X to 



CHAPTER 5. FAULT-TOLERANT COMPUTATION 



55 



the third ancilla qubit if it is \B). This means we will always have prepared the 
state \A). 

To perform ( |5.28| ), we will have to perform the operation \A) — > |^4) and 
\B) — ► — \B) if and only if the qubits of the cat state are |1 . . . 1). If the qubits 
of the cat state are |0 . . . 0), then we do nothing to the rest of the ancilla. I will 
show that we can apply \A) — > \A) and \B) — > —\B) using a series of transversal 
operations and measurements. If we apply these operations and measurements 
conditioned on the corre spon ding qubit from the cat state being |1), then we 
have actually performed ( 5.28 ). Conditioning the operations on the cat state bit 
will generally involve using Toffoli gates and possibly other gates outside N(Q), 
but they are all gates on single qubits rather than blocks. We assume we know 
how to perform universal computation on individual qubits, so these gates are 
available to us. 

The state \A) is a +l-eigenvector of M3, from equation ( 5.24 ). \B) is a — 1- 
eigenvector of the same M 3 , so applying M 3 does, in fact, transform \A) — ► \A) 
and \B) — > —\B). M3 is just a conditional sign on the first two qubits (i.e. an 
overall sign of —1 iff both qubits are |1)) times a z on the third qubit. Therefore it 
is in N{Q) and can be performed transversally for any stabilizer code. Therefore, 
we can perform universal computation using any stabilizer code. 



5.8 Construction of Gates in N(Q) 

In order to use the general fault-tolerant protocols, we need to apply three- or 
four-qubit gates. Suppose our basic gates are limited to one- and two-qubit 
gates. These gates are sufficient to give us any gates in N{Q). I will now give a 
construction for any gate in N{Q) using one- and two-qubit gates. 



The construction will be inductive. In section 5.6, I showed that any one- or 
two-qubit gate could be made using R, P, and CNOT. Suppose we can construct 
any rt-qubit gate using one- and two-qubit gates, and let U be an (n + l)-qubit 
gate. Using swaps and one-qubit gates, we can guarantee that 

M = Ua zl U^ = <j x1 ® M' (5.32) 

and 

N = Ua xl U^ = I® N' or a zl <g> N' . (5.33) 
Note that {M, N} = 0. Suppose 

U(\0) ® = |0> ® |Vi> + |1) <8> |V>2>, (5.34) 

where \xjj), \ipi), and \1jj2) are states of the last n qubits. The results of section pT4| 
tell us that if we measure a z for the first qubit after applying U and apply 
(which anticommutes with a z {] if the result is —1, we will get |0) (g) This 
means that \ip 2 ) = M']^). Define U' by U'\ip) = \tpi). Then 



U\Q)®\il>) =(I + M)(\0)®U'\i>)). 



(5.35) 
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Now, 

U(\l)®\iP)) = U[(v x \0))®\il>)] (5.36) 

= NU(\Q)®\ip)) (5.37) 

= N(I + M)(\0)®U'\ip)) (5.38) 

= (I-M)N(\0)®U'\il>)) (5.39) 

= (I-M)QO) <g> N'U'ty)). (5.40) 

Therefore, if we first apply [/' to the last n qubits, followed by applying 
N' to the last n qubits conditioned on the first qubit, followed by a Hadamard 
transform R on the first qubit, followed by M' on the last n qubits conditioned 
on the first qubit, we have applied U : 

|0) ® M + |1) ® |0) -> |0) ® [/» + |1) <g> [/'|0) (5- 41 ) 
-» |0) (S> C/'IV 7 ) + |1> ®JV't/» (5.42) 

-> (|0) + |1)) ® c/'iv) + (|0) - |i)) ® iv'f/V) 

(5.43) 

-> (|0) ® C/'|V) + |1> <8> M'ZJ'IV)) 

+ (|0) ® N'U'\4>) - |1) ® M'N'U'\(f>)) (5.44) 

= [|0)<8U"'|V>>+M(|0)®f/'|V>>)] 

+ [|0) ® iV'J7» - M(\0) ® iV'17'1^))] (5.45) 

= (/ + M)(|0)® C/'|V)) 

+ (/-M)(|O)®AT / J7 / |0)) (5.46) 

= [/(|0)®k/>)) + [/(|l)®|^)) (5.47) 

= C7(|O)®|-0) + |l)® 1^)). (5.48) 

{/' is an n-qubit gate in N(Q), which, by the inductive hypothesis, we can 
perform using one- and two-qubit gates. Both M' and N' are in Q, so apply- 
ing them conditioned on the first qubit requires only two-qubit gates in N(Q). 
Therefore, this construction allows us to perform any U in N(Q) using only one- 



and two-qubit gates. The construction is summarized in figure 5.3. 

To get M and N in the correct form requires only identifying a single qubit 
on which M does not act as the identity and N acts differently from M. From 
there, a single one-qubit gate and a swap between that qubit and the first puts 
M and N in the desired form. It is not really necessary for the construction 
that the selected qubit be in the first position, so we can actually put M and N 
in the right form using just one one-qubit gate. We also need to perform R on 
that qubit in the middle of the operation. Applying M' and N' conditioned on 
the selected qubit uses up to 2n two-qubit gates. Therefore, this construction 
of U uses the gates in U' plus up to two one-qubit gates and 2n two-qubit 
gates. Thus, by induction, an (n + l)-qubit gate (n > 2) can use up to 2(n — 2) 
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Figure 5.3: Recursive construction of gates in N(Q). 
one-qubit gates and 

n+l 

1 + 2(j - 1) = 1 + (n + 2)(n - 1) = n 2 + n - 1 (5.49) 
two-qubit gates. 

Note that this construction can also be used for encoding data into a stabi- 
lizer code. The map U will map a x i — > and o>j — > (i = 1, . . . , fc) for the fc 
data qubits. The remaining n — k qubits start out as |0), so for i = k + 1, . . . , n, 
we map a Z i — > Mi_fc, where Mj (j = 1, . . . ,n — k) are generators of S. Any 
remaining freedom for the choice of the image of a X i for i = k + 1, . . . , n is 
unimportant. This produces an encoding for any stabilizer code using any X 
and Z operators in N(Q). In some cases, it may be more efficient than the 
construction given in chapter ^, but the upper bound for efficiency is higher. 

5.9 Refining the Error Correction Algorithm 

Since errors occur while we are measuring the error syndrome, we are inevitably 
led to a race between the errors that are constantly occuring and our ability to 
correct them. Therefore it is desireable to be able to perform error correction 
as efficiently as possible. In this section, I will discuss a few ways of speeding 
up error correction. 

One significant improvement is to do classical error correction on the syn- 
drome bits EfJ . The most basic form of error correction described in section p.'2\ 
measures the eigenvalues of the n — k generators of S. If we treat these as 
classical bits, we can encode them using a classical [m, n — k, d'] linear code. 
The bits of the classical codeword will be linear combinations of the original 
syndrome bits, which means they will correspond to eigenvalues of products of 
the generators of the stabilizer. This means we need only measure these m new 
elements of the stabilizer. Then we can do classical error correction on the result 
to extract the actual (n — fc)-bit syndrome. If there were less than d' errors on 
the measured syndrome bits, we can still determine the real syndrome. This 
protects very well against ancilla errors that produce the wrong measurement 
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result for a single syndrome bit. It protects less well against data errors that 
cause the syndrome to change in the middle of measurement, but there is a 
good chance it will warn us when such an error has occurred. If no errors are 
detected using the classical code, it is quite likely we have measured the correct 
syndrome. There is still a chance that we have not, so we may want to repeat 
the measurement, but we will not have to do it as many times to produce the 
same level of confidence in the result. 

Another possible improvement is to reduce the number of qubits needed to 
perform error correction. Below, I present a method due to Steane jl7). This 
method puts more effort into preparing the ancilla, allowing a reduction in the 
number of operations performed on the data. In some situations, this results 
in an improvement in error tolerance; in other situations, the effort spent in 
preparing the ancilla is too large, and this results in worse tolerance for errors. 

Steane's ancilla state uses 2n qubits, which are prepared in the sum of the 
states of a classical code. The specific classical code is formed by taking the 
two matrices in the binary vector space representation of S (section |3.4| ) and 
tacking them together into a single (n — k) x 2n matrix. The matrix for the a z 's 
is first. This is the parity check matrix of the classical code. The ancilla state 
can be described by a stabilizer Sa on 2n qubits. The first n — k generators of 
the stabilizer are the rows of the parity check matrix with cr 2 's for the Is. The 
remaining n + k generators of the stabilizer are the n + k independent tensor 
products of cr^'s that commute with the first n—k generators. Note that the 
fact that S is Abelian means that n—k of the new generators will also be formed 
directly from the generators of the stabilizer, this time by combining the a x and 
a z matrices with the a x one first and replacing Is with cr^'s. There is only a 
single state in the Hilbert space fixed by all 2n of these generators, and that is 
the desired ancilla state. 

For instance, if the original code is a CSS code such as the seven-qubit code, 
the resulting ancilla state is the tensor product of two ancilla states, each in the 
superposition of all the states in one of the two classical codes that make up the 
CSS code. For the seven-qubit code, that means two copies of |0) + |1), where 
|0) and |1) are the encoded and 1 states for the seven-qubit code. In general, 
the classical code will be able to identify as many errors as the quantum code 
can, counting errors in both bits j and j + n (for j < n) as a single error. 

Once we have this anci lla, we should again verify it, as we did for the "cat" 
states in sections 5.2 and 5.7. Then we apply a CNOT from data qubit i to 
ancilla qubit i, followed by a Hadamard transform R on the data qubit and 
a CNOT from the ith data qubit to the (n + i)th ancilla qubit, followed by 
a final Hadamard transform on the data qubit. Assuming no phase errors in 
the ancilla, the data qubit ends up in its original state. We can see this by 
looking at the stabilizer of the ancilla. The last n + k generators M of Sa are 
all tensor products ofay's, so the CNOTs simply map J(g>M — » I<g>M, which is 
obviously still in S x Sa- The first n — k generators are tensor products of a z 's, 
say Mi (g) M2 (with Mi and Ma n-qubit operators). The CNOTs then map 

/ (Mi <g) M 2 ) -> Mi(i?M 2 i? f ) ® (Mi ® M 2 ). (5.50) 
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But Mi has a a z anywhere some element M e S does and RM2R^ has a cr^ 
anywhere the same M does, so M Y (RM 2 R)) = M, and Mi(i?M 2 i? t )(X)(Mi(8)M 2 ) 
is in S x SU. 

The effect of the CNOTs on the generators M of S is to copy the cr^'s forward 
into the first n qubits of the ancilla and the a z 's forward into <7 x 's in the last n 
qubits of the ancilla. That is, M <g> I — » M <g> (Mi <g> M 2 ), where Mi and M 2 are 
the product of <7 x 's, and Mi ® M 2 is one of the second set of n — k generators 
of Sa- Therefore a correct codeword will have no effect on the ancilla. 

Measuring a z on each of the 2n ancilla qubits will therefore give us a random 
codeword from the classical code without disturbing the data or the quantum 
code. A bit flip error in the jth qubit of the quantum code will carry forward 
to a bit flip error in the jth qubit of the ancilla, and a phase error in the 
jth qubit of the quantum code will produce a bit flip error in the (n + j)th 
qubit of the ancilla. Therefore, errors in the quantum code will produce bit 
flip errors in the measured classical codeword. The actual codeword tells us 
nothing, but the error syndrome will identify the error in the quantum code. 
As with the cat state method, an incorrect ancilla qubit can result in the wrong 
error syndrome, but repeating the error syndrome measurement can give an 
arbitrarily high confidence level to the result. Singlc-qubit phase errors in the 
ancilla will just feed back to single-qubit phase or bit flip errors in the data. 
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Concatenated Coding 



6.1 The Structure of Concatenated Codes 

Encoding data using a quantum error-correcting code and applying fault-toler- 
ant operations to it may or may not actually improve the basic error rate for the 
computation. Since the gates involved in error correction are themselves noisy, 
the process of error correction introduces errors at the same time it is fixing 
them. If the basic gate error rate is low enough, the error correction will fix 
more errors than it introduces on the average, and making a fault-tolerant com- 
putation will help rather than harm. If the error rate is too high, attempting to 
correct errors will introduce more errors than are fixed, and error correction is 
actively doing harm. Even if error correction helps rather than harms, statisti- 
cal fluctuations will eventually produce more errors than the code can correct, 
resulting in a real error in the data. Furthermore, the extra computational 
overhead required to do fault-tolerant operations may counteract the additional 
resistance to errors provided by the code, so the encoded computer may not be 
able to do longer computations than the original computer. 

Nevertheless, if the basic error rate in the quantum computer is low enough, 
we will be able to do longer computations using quantum codes and fault- 
tolerance than we could without them. Suppose we can get a certain amount 
of improvement by using a specific code, say the seven-qubit code. We might 
imagine that by using a code that corrects more errors, we could do a longer 
computation yet, and by increasing the number of errors the code corrects in- 
definitely, we could do arbitrarily long computation. However, for arbitrary 
families of codes, the number of steps required to do error correction may in- 
crease rapidly with the number of errors corrected. Therefore, the time required 
to do error correction may eventually overwhelm the capability of the code to 
deal with errors, and the performance of the computer will start to decrease 
again. To solve this problem, we need to find a class of codes where the time 
to measure the error syndrome increases only slowly with the error-correcting 
capabilities of the code. 
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The desired class of codes is concatenated codes |34|, [h| [f9|. For a 
concatenated code, the data is encoded using some [n, k, d\ code, then each 
qubit in a block is again encoded using an [n,i, 1, di] code. The qubits making 
up blocks in the new code may be further encoded using an [712, 1, cfc] code, and 
so on indefinitely. The result is an \nri\n2 • ■ ■ Hj-i, fc, ddid% ■ ■ ■ dj_i] code. We 
can find the error syndrome of such a code rather rapidly. We measure the 
error syndrome for the [nj_i, 1, di-%] code (the /irsi level of the code) for all of 
the blocks of n/_i qubits at once. To do this, we must make the assumption 
that we can do parallel computation on different qubits. Note that we need this 
assumption anyway, or storage errors will always build up on some block while 
we are correcting errors on the other blocks. Similarly, we measure the error 
syndrome for the [n/_ 2 , 1,^-2] code at the second level of the code in parallel 
for different blocks, and so on, for all I levels of the code. Therefore, we can 
measure the error syndrome for the whole code in only the sum of the number 
of steps required to measure each constituent code, instead of something like 
the product, which would be a more typical complexity for a code of the same 
parameters. 

In order to analyze concatenated codes, it is useful to make a few simplifying 
assumptions. One assumption is that we are using the same code at every level. 
One particularly good code for this purpose is the [7,1,3] code, because any 
operation in N(Q) can be immediately performed transversally, keeping the 
overhead for fault-tolerant computation small. In addition, it is a small code, 
so the complexity of error correction is not too large. Allowing varying codes 
at different levels may improve the space efficiency of the code, but it will not 
change the basic results. The other simplifying assumption is that the operations 
at level j are basically similar to operations at level j + 1. Each level feeds 
information about error rates for different gates and storage errors and relative 
times for the different operations to the next lower level, but nothing else. Error 
correction at each level is an independent process. Note that this will impair 
the error-correction properties of the code, since the full minimum distance of 
the code assumes that we combine information about the error syndrome from 
all the different levels. However, even with this assumption, we will find that 
for low enough basic error rates, we can do arbitrarily long computations with 
arbitrarily low real error rates by using sufficiently many levels of concatenation 
(the basic error rate is the rate of errors in actual physical qubits due to gates 
or storage errors; the real error rate is the rate of errors in the encoded data). 
When the basic error rate is low enough, adding an extra level of concatenation 
further reduces the real error rate; if the basic error rate is too high, adding an 
extra layer increases the real error rate because of the extra time spent on error 
correction and calculation. 

In this chapter, I will present a rough calculation of the error threshhold 
below which arbitrarily long computation is possible. In my discussion, the 
zeroth level of the code consists of the individual physical qubits making it up. 
These qubits form the blocks of a [7,1,3] code. Each block of seven physical 
qubits forms a qubit at the first level of the code. In general, qubits at the 
jth level of the code consist of 7 J physical qubits. There are a total of / levels 
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in the code. The qubits at the Ith level are the real data qubits. We wish 
to keep the effective error rate on these qubits as low as possible. For this 
calculation, I will assume that storage errors occur independently on different 
physical qubits with rate p a tor ■ The error rate for any one- or two-qubit gate in 
N(Q) will be p g , and the error rate for the Toffoli gate will be prof- I assume 
any gate may produce correlated errors on the qubits affected by the gate, but 
will produce no errors on any other qubits. There will be an additional storage 
error on qubits unaffected by the gate, but the storage error is included in the 
gate error for qubits that are affected by the gate. All the errors are assumed 
to be stochastically distributed, so the error probabilities for different qubits 
will add instead of the error amplitudes in the quantum states. In addition, the 
error rates for state preparation and state measurement will be important. I 
will denote them by p prep and p me as , respectively. 

The computation will call for various operations performed on the qubits 
encoded at various different levels. After any operation at level j, I will per- 
form error correction at level j. This means we can give an effective error rate 
to each operation at level j. The fact that a given error rate refers to a gate 
at level j will be noted by a superscript (j). Thus, p^t or is the storage error 
rate on the physical qubits, while p^p is the effective error rate on the data 
qubits from performing an operation in N{Q). Only allowing one gate per error 
correction will typically reduce the performance of the code. Errors created 
during error correction will dominate; an optimized code would perform error 
correction when the expected accumulated chance of errors was roughly equal 
to the chance of errors during error correction. However, the assumption of 
one gate per error correction is another very useful simplifying assumption be- 
cause it preserves the self-similar character of the concatenated code, allowing 
a relatively straightforward recursive calculation of the real error rates. 

Some logical operations, such as the Toffoli gate, will require more and more 
physical operations as the level increases. The basic time required to perform 
a physical operation will be 1, and the storage error rate (at any level) is the 
error rate per unit time. The time to perform a Toffoli gate at level j will be 
denoted t^p a j. Because operations in N(Q) can be performed at any level just 
by performing a single operation from N(Q) in parallel at the next lower level, 
the time to perform an operation in N(Q) at any level is just 1. The time to 
prepare a state encoded at the jth level is t pre p and the time to measure a qubit 

at the jth level is tmeas- tpfiep = and tmlas = 1. 

6.2 Threshhold for Storage Errors and Gates 
From N(Q) 

To determine p^p in terms of quantities at level j — 1, wc note that a gate in 
N(Q) at level j consists of a single gate in N(Q) on each of the constituent 
qubits at level j — 1 followed by a full error correction cycle at level j — 1. In 
order for the level j gate to have an error, there must be two errors at level 
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j — 1, either in the N(Q) gate or in the error correction. I will assume that there 
is no residual error that was missed in an earlier error correction step. A more 
careful calculation should consider such leftover errors, which can be significant. 
Suppose the chance of an error occuring in a single data qubit during a single 
measurement of the error syndrome is pec- There are a few possible situations 
that result in an error at level j. Two errors at level j — 1 could occur in any 
of (£) =21 choices of two qubits. This could occur from two N(Q) gates going 
wrong, with probability {p^ ^) 2 . We repeat the error syndrome measurement 
until we get the same result twice. If there is one error from an N(Q) gate 
and one from either of these measurements of the error syndrome, there will 
be an error at level j. The probability of this is Apg^^psc- Finally, both 
errors could come from the error correction. This could be two errors in the 
first or second syndrome measurement, with probability 2<Pec- Given one error 
in a syndrome measurement, we will need to do three syndrome measurements 
total. If two of those go wrong, it will also produce an error at level j. This 
has probability 6p 2 EC . There are also a number of possibilities involving an 
error in the ancilla state producing an incorrect syndrome and requiring more 
measurements. However, I assume the error rates involved are all fairly low, so 
the probability of this situation producing an error at level j is smaller by O(p), 
which I will assume is negligable. Thus, the total gate error rate at level j is 

p£> = 21 ((pW- 1 )) 2 + ApV-VpEC + 8p|c) • (6-1) 

Similarly, a single time step at level j without a gate involves a single time step 
without a gate at level j — 1 followed by error correction. Therefore, 

p% = 21 f + ^tor } PEC + Splc) ■ (6-2) 

The salient aspect of these equations is that the probability of error at level 
j is of the order of the square of the error rate at level j — 1. This means that 
p^P will scale roughly as 

P g °HP g 0) /Pthres h f (6.3) 

for some threshhold error rate pthresh and similarly for p^} or . This is a very rapid 
decrease in p g 1 ^ as a function of I when p g ^ < pthresh- We will thus only need a 
few levels, of order log(logp) to bring the real error rate down to 0{p) per step. 
Thus, the number of extra qubits necessary for a fault-tolerant computation is 
only polylog p times the original number, which is a very good scaling. However, 
while the asymptotic scaling is quite good, for vaguely reasonable p, the actual 
number of extra qubits needed is quite large. 

In order to determine the threshhold pthresh, let us calculate pec- I will 
assume we are using Shor's cat state method to correct errors, although another 
method (such as Steane's) might ultimately lead to better performance. We 
have to measure six syndrome bits, so we will need to prepare six cat states, 
each using four qubits. I will assume a limited ability to plan ahead in the 
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Figure 6.1: Cat state construction and verification. 



calculation, so the data qubits will have to wait for the first cat state in a single 
measurement of the error syndrome, but the other cat states are being prepared 
at the same time, so they will be ready just when they are needed. To prepare 
a cat state, we start with all four qubits in the state |0) (encoded using the code 
at level j ~ 1), perform a Hadamard rotation R on the first qubit, then a CNOT 
from the first qubit to the third qubit, and then two more CNOTs, from the 
first qubit to the second and from the third to the fourth, as shown in figure 6.1. 
Bit flip errors at this point will become phase errors after the final Hadamard 
transform, so we need to ensure that there is at most one. Every way a single 
gate error earlier in the construction can produce two bit flip errors here makes 
the second and fourth qubits different. Therefore, we perform CNOTs from the 
second and fourth qubits to an additional ancilla test qubit and measure the 
test qubit. If it is |0), we can use the ancilla; if it is |1), there is at least one 
error in the cat state, possibly two. We throw the cat state out and construct 
another one. Finally, we must perform a Hadamard transform on each of the 
four qubits in the cat state to get the actual ancilla used in error correction. 

An examination of the circuit shows that any bit flip errors before the cycle 
in which there are two CNOTs will cause the test qubit to flip. Therefore, only 
errors at this stage or later will have a chance of affecting the actual ancilla used. 
For the second and fourth qubits, the error must actually occur after (or during) 
the CNOT to the test qubit. Therefore, the chance of an important error in 
any single ancilla qubit is 2p g + p s tor (for qubits two and four) or p g + 2p s t or 
(for qubits one and three). Although only phase errors can feed back, the fault- 
tolerant network does not treat a x and <j z errors symmetrically, so in order to 
be safe, I will consider the worst case where every error is of the most dangerous 
type. However, in no case can an error in the test qubit feed back into the data 
qubits, so I have not included errors from this source. 

Now, we can construct a network for error syndrome measurement such that 
each data qubit contributes to at most four syndrome bits. In addition, two 
Hadamard rotations are necessary. Therefore, the process of syndrome mea- 
surement introduces at most an additional probability 6p g + 2p stor of error. To 
this, we must add the probability of an error feeding back, plus the accumulation 
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of storage errors while we prepare the cat state and measure the ancilla. There 
is only waiting time for the preparation of the first cat state and measurement 
of the last one, since preparation and measurement of the other cat states is 
taking place in parallel. Feedback is a more serious problem, but we can arrange 
it so that no data qubit interacts with more than two ancilla qubits with error 
rate 2p g + p s t or , so the total feedback is at most 6p g + 6p st0 r- Therefore, 

PEC = (6Pg + 6Pstor) + (6Pg + 2Pstor) + (6 + tprep+t m eas)Pstor (6.4) 



Now, in order to measure a qubit encoded at some level, it is sufficient to 
measure all of the constituent qubits. At level one, this gives us some seven-bit 
string which is a codeword of the classical Hammng code (possibly with some 
errors) . Whether it is a codeword of even or odd parity will tell us whether the 
corresponding level one qubit is |0) or |1). We can continue to do this at all 
levels, using classical error correction at each level to correct any errors in indi- 
vidual bits. This will, in general, require a fair amount of classical computation. 
However, I will assume that classical computation is much faster than quantum 
computation when it can perform the same task, and that in the regime of inter- 
est, t me as = 1- No matter what the speed of the classical computer, eventually 
tmeas will become greater than one, but due to the rapid convergence of the 
double exponential, this will have a very small effect on the threshhold. 

Preparing encoded |0) states at level j — 1 does take a fair amount of time, 
however. Furthermore, the amount of time will increase with level. One way to 
prepare encoded states reliably is by performing a full error correction cycle 
for the code with the addition of the Z operator a z ^a z %a z i. The input state 
can be anything. The time to do this is at most 4(^c + !)• Recall that we 
must get the same error syndrome twice before we trust it. If there is an error 
in the second syndrome measurement, we may have to measure the syndrome 
twice more, for a total of four times. The chance of two errors is lower order, 
and therefore we ignore it. 

The time for one error correction cycle is tEC = 14 + t prep + t meas , so 
tpXp = 64 + Atp r Zp ■ In order to cut down the growth rate with level, I will 
assume we can plan ahead enough to prepare the ancillas for later syndrome 
measurements while measuring the earlier syndromes. Then tprep — 43 + tprep ■ 
Recalling that t p °Jep — 0, we then get tpj ep — 43 j. One benefit of preparing 
states using error correction is that the chance of residual error is minimal. I 
will take p pre p — where it matters. 

Finally, we get the result for pec- The t prep that contributes is actually 
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+ [37800 + 216720(j - 1) + 310632(j - l) 2 ] (pHorV (6.8) 

(P^f + ^tor ] PEC + 8p| C ] (6.9) 

= 24192 (p^) 2 + [61488 + 173376(j - 1)] p^p^ 

+ [39081 + 220332(j - 1) + 310632(j - l) 2 ] (pH~ 1} ) 2 - (6.10) 

Note a number of things here. If we perform error correction after every time 
step, whether it has a gate or not, the storage error rate and gate error rate at 
the next level will actually be dominated by the error rate of error correction, 
so they will be very close. Also, at levels beyond the first, the error rate is 
dominated by storage errors occuring while we wait around encoding the ancilla 
qubits for error correction. Therefore, the algorithm will benefit greatly from a 
more rapid preparation algorithm, a better ability to plan ahead, or both. 

First, consider the limit in which storage errors arc ncgligable. In this case, 
we do not perform error correction after a step without a gate. Therefore, 
p'ftlr = at all levels. Then, p ( p = 25221 (pi/ ~ 1} ) 2 , and the threshhold for 
a computation involving only operations from N{Q) is Pthresh = 1/25200 = 
4.0 x 10~ 5 . A second limit would be when pf^ = pftori so there are no gate 
errors beyond the simple storage error in the same time step. Then they should 
be equal at all other levels, as well. Then 

p&r = [124761 + 393708(j - 1) + 310632(j - l) 2 ] (p^) 2 . (6.11) 
Then p ( s ]l = 124800 (pH) 2 , p$ or = 8.3 x 10 5 (pi) 2 , and p^ or = 2.2 x 



10 6 {pastor) 2 - For higher j, we approximate 



P 
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stor 



3.1x10 s (i-l) 2 ^"^) 2 = Uj l) 2 pW/{3.2 x 10- 6 )1 pW. (6.12 



To get continual improvement, it is sufficient for P^tor I P^stor^ < U ~ l) 2 /.?' 2 - 
This will mean p^ or < jzpf? or . It suffices for p { s f or = ^p { ^ or , so pf? or = 
Yg(3.2 x 10~ 6 ). Following this back, we find that for only storage errors, the 
threshhold is roughly pthresh = 2.2 x 10~ 6 , or slightly more than an order of 
magnitude worse than for just gate errors. 

Let us consider another case. Suppose we can plan ahead well, and prepare 
ancillas for error correction just in time for when they are needed. Then pec ~ 
Ylp g + 9p st or, and 

p« - 25221 (p^- 1 )) 2 + 37044pW- 1 )p^ 1) + 13608 (pi^) 2 (6.13) 
pHL = 24192 (p«- 1 )) 2 +37296p«- 1 )p a t i- 1) + 14385 (p^f. (6.14) 

For all practical purposes, for j > 1, p ( p = p^ or = = 75873 (p^'" 1 )) 2 . This 
means that the threshhold occurs at p (1) = 1/75873 = 1.3 x 10~ 5 . At the limit 
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0, we get a threshhold for p g of pthresh = 2.3x10 5 . At the limit 

resh = 1.3 X 10" 5 . 

Finally, suppose we do not do error correction after every step, but instead 
attempt to optimize the number of steps N between error corrections. Then 
the chance of error in N steps is Npg* or Np^ to ^\ and equations fl6.l| ) and 
(|6~^) become 
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(6.16) 



(7) (7) 

The values p g and p^,, now represent average error rates, rather than strict 
error rates per step. As long as we do gates from N(Q) only or storage only, 
these values will be accurate representations, but if we mix and match, the story 
will be a bit different. Optimizing with respect to N gives us 
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(6.19) 
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The same is true for storage steps. The optimum number of steps makes the 
accumulated chance of error during gates y/8 times the chance of error during 
error correction. Plugging in this value for N gives us 



SV2)p 2 EC . 



(6.22) 



Assuming no storage errors, pec = 12p ff 



O-i) 



so N = 34 and p { g o) = 2.4 x 



10 3 {p { J 1} ) 2 , so the threshhold is pthresh = 4.1 x 10 4 . In practice, we will not 
be able to perform error correction after exactly 34 gates, since there will be 
Toffoli gates occuring at possibly inconvenient times, but if we get close to the 
right frequency of error correction, the actual threshhold will not be too much 
worse than this. 



6.3 Toffoli Gate Threshhold 



To figure out the recursion relation for the Toffoli gate, look at figure 6.2, which 
summarizes the construction in section 5.7. I will follow each qubit individually 
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Figure 6.2: The Toffoli gate construction. Each line represents seven qubits at 
the next lower level. 



in order to figure out the final chance of error for that qubit. This is a construc- 
tion for the Toffoli gate at level j + 1. I will assume we do error correction on 
all three ancilla qubits only after the Toffoli gate is completed. All three ancilla 
qubits start out with PprtP chance of error from preparing encoded |0)'s. There 
are actually two types of relevant encoding errors. There can be errors remain- 
ing at lower levels. Since we have just done an error correction cycle, I assume 
that the number of residual errors is negligable. There is also a chance that the 
qubit will not be an encoded |0), but some other encoded state. This would 
count as a complete failure of the Toffoli gate, since it would produce a real 
error at level j + 1. However, I will assume that the chance of this happening 
is also zero. 

Assume the chance of a remaining bit flip error in a cat state is p ca t and the 
time to make a cat state is t cat - Only bit flip errors feed back from the cat states 
to the ancilla qubits in this network. Let A\, A 2 , and A3 be the accumulated 
chances of error in the three ancilla qubits. First we have a Hadamard transform 
on all three of these qubits. After the first gate in the ancilla construction, 
^3 = tcatpiHr + 2pg^ + Peat- It will have to sit around an additional 1 + dp f 
time steps before the interaction with the next cat state begins. Thus, after the 
first cat state is finished, A 3 = (t cat + if^/ + ^)P^stor + ^Pg^ + Pcat- By the time 
of the Toffoli gate with the first two ancilla qubits, the chance of errors in the 
cat state which can feed back into the main ancilla is at most p ca t + 2p g ■ The 
first two ancilla qubits have already waited a time t cat + 2, so the overall chance 
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of errors in the first two ancilla qubits is 

Ai = A 2 = {teat + 2)p$ or + Pcat + 3pf + p f or (6.23) 

We repeat the cat state interaction two more times with new cat states, 
which we have been preparing in parallel with the first cat state. Therefore, we 
only need 2 + tj^j more time steps for each interaction, introducing the same 
amount of error as the equivalent steps in the first interaction. We must also 
measure the cat states. We can do it in the basis they end up in; we check for 
odd or even parity. If two of the three cat states have odd parity, we decide the 
ancilla is in the state \B), and we perform a x on the third ancilla qubit. This 

process will take an additional t m \as + 1 time units. After the ancilla creation 
is completed, the chances of error on the three qubits are 

Ai = (t cat + t$ eas + 7) P ( £. + 3 Pcat + l V f + 3p<f of (6.24) 
A2 = (t cat + t m \ as + 7) pHL + 3Pcat + 7p«> + 3p% (6.25) 
A3 = (tcat + tiil as +34l f + 3)p { £ or + 3 Pcat + 5 P ^. (6.26) 

The whole ancilla construction has taken a time t cat + tmeas + ^Tof + ^, during 

which time the data qubits have been accumulating storage errors. I assume 

(7) 

here that t cat > tp re p + 1 • 

Now we perform the CNOTs between the data qubits and the ancilla qubits. 
Again we make the conservative assumption that all of the accumulated chance 
of error on the data qubits feeds into the ancilla qubits. Thus, 

Ai - (2t cat + 2^L + *4l f + 14) V ( L + ZPcat + 8P^ + 3p% (6.27) 
A2 = (2t cat + 2t$ eas + 3t% + 14) p$ or + 3 Pcat + 8 P ( f + 3p% (6.28) 
^3 = (2t cat + 2tW as + 6i^ / + 10)pi£ r + 3p cat + 6p«. (6.29) 

Now we measure o z for the first two data qubits and a x for the third data qubit. 
We will add one time step for the Hadamard rotation on the third data qubit, 
plus t m \as to measure. We should include a chance of the Toffoli gate failing 
because of the wrong result on one of these measurements, but I will assume 
that chance is small compared to the accumulated errors on the ancilla qubits. 
Before we start doing the conditional operations to convert the ancilla states to 
complete the transfer of the data, the chances of error are 

Ai = (2t cat + 3t m \ as + 3t% + 15) pHL + 3p cat + 8 P ( f + 3p% (6.30) 
A2 = (2t cat + 3t m \ as + 3tf of + 15) p^l + 3 Pcat + 8 P ( f + 3 P %. (6.31) 
^3 = (2t cat + 3tlil as + 6t% + n)p^ r + 3p cat + 6p^. (6.32) 
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I will now assume that all three operations are necessary; this is the worst 
case, and usually there will be fewer gate errors. The first conditional operation 
interacts ancilla qubits one and two, giving 

M = (4i C a* + 6^ eas + M% + 30) p<£ r + 6 Pcat + 17p« + 6 P %(6.33) 

M = (4i C at + 6^L S + M% + 30) p { £ or + 6 Pcat + 17p« + 6^(6.34) 

A 3 = (2t cat + 3tlil as + 6iSl f + n)p { £ or + 3p cat + 7p^. (6.35) 

The second conditional operation interacts ancilla qubits one and three, so 

M = (6t cat + 9tHL + m% + 4l) pHL + VPcat + 25p« + 6p%. (6.36) 

A 2 = (Uca t + 6tiil as + U% + 30) pHL + SPcat + 18pW + (6.37) 

^3 = (6tc„t + 9i# eas + 12^/ + 34) p<£ r + 9p cat + 25p« + 6^.(6.38) 

The third operation interacts the second and third ancilla qubits. Much of the 
error from the first and second ancilla qubits has already been introduced into 
the third qubit, so there is no need to add it again. In fact, much of it may cancel 
out instead. However, I assume it remains. The only new error for the third 
ancilla qubit is the gate error on the second qubit from the previous operation 
plus the gate error for this operation. Thus, 

A 1 = (6t cat + 9tii\ as + \2tf of + 4l) p<£ r + 9 Pcat + 26p« + 6p% (6.39) 

A 2 = (&t cat + 9t$ eas + 12t% + 4l) pHL + QPcat + 21pf + 6 P % (6.40) 

A 3 = (6t cat + 9t ( £ as + 121% + 4l) p« r + 9 Pcat + 21pf + 6 P %.. (6.41) 

The overall chance of error on a single one of the new data qubits after the full 
Toffoli gate construction is thus 

(6t cat + 9^L + W%l f + 4l) pHl + VPcat + 27pf + 6p%. (6.42) 
The time taken to perform this Toffoli gate is 

= teat + 2^L + + 12. (6.43) 

After error correction, the chance of a real error at level j + 1 is 

PTof ] = 21 { \{6tcat + 9tHl as + 12t%. + 41) + 9p CQt + 21pf + 6p£>/ * 




(6t cat + 9t$ eas + 12t%. + 41) + 9p cat + 21pf + 6 P % 



Pec 
(6.44) 
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In order to simplify the recursion relation so that it is easily solvable, I will only 
investigate the limit where there are no storage errors. In this case, it makes 
sense to verify the cat state used in the construction until the chance of errors in 
it is negligable. Therefore, I will also assume that p ca t = 0. Then the recursion 
relation for the Toffoli gate becomes 



Prof 



21 



(27p« 



4(27p« 



6p { To f )PEC + 8p 2 EC (6.45) 



= 66717 (p«) 2 + 12852p«)p^ / + 756 {pf o} ) 
Recall that in this limit, p { J ] = 25221 (p^ _1) ) 2 , so 

p& = 25200 a «(pf f, 
where a(j + 1) = 1 + 2a(j), with a(l) = 1. Therefore, a(j) = 2 J — 1, and 



4.0 x 10~ 5 



p( 0) /(4.0x 10~ 5 ) 



= Pth 



resh (p^/P 



thresh 



Writing e = pf ^/pthresh, we have 



v U+1) - 1 1 
Prof — 1 - 1 



x 10- 4 e 2J+1 



+ 0.51 e v p%\ s + 756 (p^> f ) 



(6.46) 
(6.47) 

(6.48) 
(6.49) 

(6.50) 



The first term is often negligable compared to the second term, in which case 



Prof 



(0Me*+756p%)p%. 



(6.51) 



In the limit where e is small, we find a thrcshhold value of p^lf = 1/756 = 
1.3 x 10~ 3 . 

Even when e is fairly large, the presence of Toffoli gates does not present 
much of a problem for the thrcshhold. For instance, if we demand that P^lf — 



P { g ] = tPthresh, then 



„(1) 

Prof 


= 1.1 x 10" 


-4 £ 2 


+ [12852p thresft e + 756 Pthresh^Pxlf 


(6.52) 




w 1.3x10" 


-4 £ 2 




(6.53) 


Prof 


= 1.1 x 10" 


-4 £ 4 


+ [0.51 e 2 + 756 (1.3 x 10~ 4 ) e 2 ] p ( ^ of 


(6.54) 




= 1.9x10" 


-4 £ 4 




(6.55) 


(3) 

Prof 


= 1.1 x 10" 


-4 £ 8 


+ [0.51 e 4 + 756 (1.9 x 10~ 4 ) e 4 ] p^ of , 


(6.56) 




= 2.3x10" 


-4 £ 8 




(6.57) 



If we let e 4 = 1.9/2.3, so e w 0.95, then = Pt<1/' an( ^ as we ao -d levels of 
concatenation, the Toffoli gate error gate will begin to improve. Therefore, the 
presence of Toffoli gates with the same physical error rate as other gates causes 
less than a 5% reduction in the threshhold. 
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Chapter 7 



Bounds on Quantum 
Error-Correcting Codes 



7.1 General Bounds 

The question of how efficient an error-correcting code of a given block size can 
be made in terms of both encoded qubits and distance is an interesting and im- 
portant question in the theories of both classical and quantum error correction. 
In the classical theory, only upper and lower bounds exist on the efficiency of 
codes that must have a given minimum distance between all codewords. The 
true, achievable bounds on such codes are unknown. Better understood in the 
classical case is the asymptotic efficiency of coding (where we only require that 
the code correct all likely errors). In the limit of infinite bits sent, we usually 
require the code to correct measure one of the errors occuring using some proba- 
bility measure associated with the channel. Classically, Shannon's theorem tells 
us what the achievable capacity of a channel is. No real quantum analogue of 
Shannon's theorem is known, despite extensive work on the subject [ |50[ |5j , |52f . 

One simple upper bound on the efficiency of quantum codes is the quantum 
Hamming bound |53|. For a nondegenerate code with basis codewords and 
possible errors E a , all of the states E a \ipi) are linearly independent for all a and 
i. If the code uses n qubits, there can only be 2 n linearly indepedent vectors in 
the Hilbert space, so the number of errors times the number of codewords must 
be less than or equal to 2™. If the code corrects all errors of weight t or less and 
encodes k qubits, this means 



these errors can be tensor products of a x , a y , and a z . This bound is completely 
analogous to the classical Hamming bound, with two differences: the quantum 




(7.1) 




ways to choose j qubits to be affected by j errors and 3^ ways 
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bound has a factor of 3 J reflecting the additional quantum-mechanical degrees 
of freedom; and the quantum bound only applies to nondegenerate codes. The 
distinction between degenerate and nondegenerate codes is a purely quantum- 
mechanical distinction; there arc no classical degenerate codes. It is unknown 
whether there are any degenerate codes that exceed the quantum Hamming 



bound (7.1) 



If we let the block size n grow arbitrarily large, we should also increase the 
expected number of errors. Consider the depolarizing channel, which is equally 
likely to have <j x , a y , and a z errors. Suppose there is a probability p of having 
one of these errors on a given qubit and 1 — p of having no error. The expected 
number of errors on a block of size n is t — np. The number of likely errors 
will be about the number of errors of length t, so the quantum Hamming bound 
becomes 

3 " P (np) ^ ~ 2 "' ( 7 ' 2 ) 
Taking the logarithm and rearranging gives us 

- <l-plog 2 'S-H(p). (7.3) 
n 

Again, H(x) = — x\og 2 x — (1 — x) log 2 (l — x), as with the asymptotic form of 



the classical Hamming bound ( 1.16 ). As with the classical case, we can achieve 
the quantum Hamming bound by using random codes. Unlike the classical case, 
this is not always the most efficient use of the channel, so ([7^) does not give 
the actual channel capacity of the quantum channel. I will discuss this question 



in greater detail in section 7.6 



For minimum distance codes, it is not in general possible to achieve the 
quantum Hamming bound. We can set a lower bound, the quantum Gilbert- 
Varshamov bound. Recall that 

(^\ElE b \^) = C ab 5 l3 (7.4) 

for a quantum code correcting errors {E a } with basis states \ipi). The matrix 
C a b is Hermitian, but is further constrained by the algebraic relationships of 
the operators E^Eb- It is better to consider C a b as a function of operators 
O = E a E . When the possible errors are all operators of up to weight t, O can 
be any operator of weight < 2t. Slightly more generally, for a code of distance 
d, O is any operator of weight less than d. Therefore, the statement 

{mlE b \i>) = C ab (7.5) 

is actually 

N = J2vh) (7.6) 

constraints on the state For generic C a b (satisfying the appropriate alge- 
braic constraints) and generic linear subspace V with dimension larger than N, 
there will be states satisfying equation (|7.5|). 
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Suppose we choose generic C a b and a generic state \4>i) satisfying (7.5). 
Now restrict attention to the subspace orthogonal to and to all 0\ipi) for 
operators O of weight less than d. For an n-qubit Hilbert space, this subspace 
has dimension 2™ — N. Choose a generic state |i/>2) in this subspace satisfying 
(f7~5|). Now restrict attention to the subspace orthogonal to both 0\ipi) and 



0\ip2)- We can again pick |^ 3 ) in this subspace satisfying (7.5), and so on. 
Choose \ipi) orthogonal to all 0\tpj) (j < i — 1) and satisfying (7.5). We can 
continue doing this as long as 



-1 



E3 J 

3=0 



i<2 n . (7.7) 



Therefore, we can always find a distance d quantum code encoding k qubits in 
n qubits satisfying 



i— 1 , 



2 k > 2™. (7.8) 



This is the quantum Gilbert- Varshamov bound. In the limit where t — pn — 
d/2, with n large, this becomes 

- > l-2plog„3-F(2p). (7.9) 
n 

The quantum Hamming bound only limits the efficiency of nondegenerate 
codes. For degenerate codes, we can still set a bound, but it will not be as 
restrictive. For an [n, k, d] code, we can choose any d — 1 qubits and remove 
them. The remaining n — d + 1 qubits must contain enough information to 
reconstruct not only the 2 fe possible codewords, but the state of the missing 
qubits as well. Because the missing qubits can be any qubits, we can choose 
them to have maximum entropy. Then 

n-d+l > d-l + k (7.10) 
n > 2(d-l)+k. (7.11) 

This is the Knill-Laflamme bound (l(| [54) . It is a quantum analog of the classical 
Singleton bound. A code to correct t errors must have distance d = 2t + 1, so 
for such a code, n > At + k. This bound holds for any code with a given 
minimum distance, whether it is degenerate or nondegenerate. For instance, 
this bound demonstrates that the smallest one-error-correcting quantum code 
uses five qubits. 



7.2 Weight Enumerators and Linear Program- 
ming Bounds 

In the classical theory of error-correcting codes, the distribution of codeword 
weights contains a great deal of information about the code. This distribution 
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is often encoded in the coefficients of a polynomial, and algebraic relationships 
between these polynomials, known as weight enumerators, can be very useful 
for setting bounds on classical codes. Many of the same ideas can be adapted 
for use with quantum error-correcting codes [^3[ |55[ |56|, p7]. 

Let Ad be the number of elements of the stabilizer S with weight d, and let 
Bd be the number of elements of N(S) with weight d (ignoring overall phases). 
Note that Bd > Ad > 0. Define polynomials 



A(z) = Y, Adzd 

n 

B(z) = Y, B d zd - 



(7.12) 
(7.13) 



d=0 



Aq = Bo = 1 always. For a code of distance d, Bd' — Ad' for all d' < d. 
For a nondegenerate code, Bd' = Ad' = for d! < d. A degenerate code has 
Bd' = Ad' > for at least one d! < d. A(z) and B(z) are the weight enumerators 
of S and N(S). 

The polynomials A(z) and B(z) satisfy the quantum Mac Williams identity 
H): 

' ' ' ' / ' ■ " " : ' (7.14) 



B(z) = — 1 -a+3zrA 



1 - z 
l + 3z 



In other words, 



d=0 



dZ 



1^4,(1-^(1+3,)' 



(7.15) 



d=0 



Matching coefficients of z d , we find 



1 - 

Bd = o^fe 



d'=Q 



s=0 



n-d! 
d-s 



A„ 



(7.16) 



To prove this, note that an operator E € Q of weight d will either commute 
with every operator M € S or it will commute with exactly half of the operators 
in S. Therefore, if we sum 

{717) 

Mes 

we will get zero if E <£ N(S) and 2™~ fc if E € N(S) (recall that f M {E) is if M 
and commute and 1 if they do not). Therefore, we can write Bd as follows: 



fu{E) 



(7.18) 



E MeS 



where the sum over E is taken over all E € Q of weight d. We reverse the order 
of summation and break up the sum over M to the sum over d! and the sum 
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over M e S of weight <i' to get 



(7.19) 



=0 M £ 



Now, any given M and B will both act nontrivially on some set of s qubits. Of 
those s, they will act as different Pauli matrices on t qubits and as the same 
Pauli matrix on s — t qubits. Now, 



(-1) 



(7.20) 



The number of operators E that agree with M on s — t qubits and disagree on 
t qubits is 

'n-d r 
d — s 



-^s — t^t^d—s I s 



(7.21) 



Note that this does not depend on M. Thus, 

d s 



1 



££££ 

d'=0 M s=Q t=0 
n d 



l' _ *(-2)* 



d'=0 M 8=0 
d 



yd— 5 



n-d! 
d — s 



n-d' 
d — s 



d'=0 M s=Q 
d'=0 ls=0 



n-d' 
d — s 



n-d' 
d — s 



A d , 



(7.22) 
(7.23) 
(7.24) 
(7.25) 



This proves the quantum Mac Williams identity (7.14) for stabilizer codes. 
The coefficients Ad and Bd can also be defined for non-stabilizer codes, and 
equation (7.14) will still hold, so any bounds derived strictly from the quantum 
MacWilliams identity will hold for any quantum code, not just stabilizer codes. 
For any code of distance d, the coefficients Ad and Bd satisfy the additional 
constraints 



B = A = l 
B d/ - A d > (d' < d) 
B d ' > A d '>0(Vd'). 



(7.26) 
(7.27) 
(7.28) 



For a nondegenerate cod e, A^ = Bd' = for d' < d. These constraints 
along with equation ( 7.14 ) restrict the allowed values of Ad and Bd- The con- 
straints are all linear, so standard linear programming techniques will find so- 
lutions. If there are no possible integer values of Ad and Bd satisfying all of 
the constraints, there is no [n, fe, d] code. Otherwise, the possible solutions 
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will give us parameters of possible codes. For instance, applying the con- 
straints for a [5,1,3] code produces the unique solution At = (1,0,0,0,15,0) 
and Bi = (1,0,0,30,15,18) f55|. Therefore, the usual five-qubit code is essen- 
tially the only [5, 1, 3] code. There are thus no degenerate five-qubit codes. 

Even tighter linear programming bounds than those produced by the quan- 
tum MacWilliams identity are possible. This can be done using the quantum 
shadow enumerator p3). The shadow Sh(S) of a code S is defined as the set of 
E £ Q satisfying 

f M {E) ee wt(M) (mod 2) (7.29) 

for all M £ S (where wt(M) is the weight of M). Define Sd to be the number 
of elements of Sh(S) of weight d (again, ignoring overall phases), and 



d=0 



S(z) is the shadow enumerator of S. Then 



(7.30) 



(7.31) 



If S contains only operators of even weight, then E £ Sh(S) iff Jm(E) = 
for all M £ S, so Sh(S) = N(S), and Sd = Bd- Furthermore, in this case, A{z) 
is an even function, so 



S(z) 



B(z) 



1 



yn — k 



(l + 3z) n A 



1 - z 
l + 3z 



= -^-r(l + 3z) n A (- — -\ 
2"- fcV ' \l + 3zj 



(7.32) 
(7.33) 



If S contains an element of odd weight, consider the subset S' C S of even 
weight operators. Then S' has exactly 2 n ~ k ~ 1 elements. This is true because 
in order for M, M' £ S to commute, they must overlap and disagree only on 
an even number of qubits. Thus, wt (MM') ee wt(M) +wt(M') (mod 2). The 
shadow of S is just Sh(S) = N(S') - N(S). Let B'{z) and A'(z) be the weight 
enumerators of 5' and N(S'). Then 



S(z) = B'{z)-B{z) 

= — \-^r(l + 3z) n A' (^—^-) 
2™- fc - lV ' \l + 3zj 



(7.34) 



' (1 + 3z) n A ( ' 



yn — k 



1 + 3z 



>n— k v J 



2A' 



1-z \ . / 1 — z 

- A 



1 + 3z 



l + 3z 



(7.35) 
(7.36) 



Now, A' d = A d for even d and A' d = for odd d, so A(z) + A(—z) = 2A'(z), and 



S(z) 



7 (l + 3z) n A 



z-l 
l + 3z 



(7.37) 
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Again, the shadow enumerator can be defined for non-stabilizer codes and 
satisfies the same relationship with A(z) as for stabilizer codes. In both the 



stabilizer and non-stabilizer case, Sd > 0. Along with (7.31), this provides addi 



tional constraints for the linear programming bound restricting the parameters 
of any code. These bounds have been applied to all possible codes with n < 30 
[ p3| p6[ . Among other things, they show that the smallest possible distance 
five code is an [11, 1,5] code and that degenerate codes in this region all fall 
below the quantum Hamming bound. The shadow enumerator can also be used 
to show that any nondegenerate code on n qubits can correct at most L^^J 
errors IBS. 



7.3 Bounds on Degenerate Stabilizer Codes 

It is still unknown whether there are any degenerate codes that exceed the 
limits set by the quantum Hamming bound, but for certain restricted cases, we 
can show that there are not. For codes using fewer than 30 qubits, the linear 
programming bounds of the previous section show this. In this section, I will 
show that the statement also is true for all stabilizer codes that correct one or 
two errors. The results can be extended slightly beyond stabilizer codes, but do 
not apply to the most general possible code. 

For a one-error-correcting degenerate code, the stabilizer S will contain one 
or more operators of weight one or two. Weight one operators totally constrain 
a qubit and both the operator and the qubit can be eliminated, converting an 
[n, A;, d] code into an [n — 1, k, d\. If the latter satisfies the quantum Hamming 
bound, the former will as well. Suppose there are I independent weight two 
operators Mi, . . . , M; in S. Let D be the group generated by Mi, . . . ,Mj. Note 
that S — D will contain no operators of weight less than three. The weight two 
operators in D tell us which errors produce the same states. For instance, if 
Mi = ct z ict z2 , c a i|V>) = o- z2 \ip) for any codeword \ip). 

Any operator in N(D) will take states fixed by D to states fixed by D. The 
total dimensionality of the subspace fixed by D is 2 n ~ l . Suppose that none of 
the operators in D acts on some qubit j. Then all of the three operators ov,-, 
ayj, and a Z j are in N(D), and they are not degenerate. Therefore, they must 
produce orthogonal states in the subspace fixed by D for each basis codeword. 
There are always at least n — 21 qubits not affected by D, since each generator 
of D can add at most two qubits. Therefore, 

[l + 3(n-22)]2 fc < 2 n - 1 (7.38) 
k < n-Z-log 2 [l + 3(n-2Z)]. (7.39) 

Recall that the quantum Hamming bound says that 

fc<n-log 2 (l + 3n), (7.40) 



so ( 7.39 ) is more restrictive when 

; + log 2 [l + 3(n-2/)] > log 2 (l + 3rc) (7.41) 
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I > log 2 
= log 2 



3n 



l + 3(n-2/) 
6? 



1 



l + 3(n-2/) 



(7.42) 
(7.43) 



Assuming n > 2/, we see that the quantum Hammi ng b ound will still hold if 
/ > log 2 (l + 6/). This is true for I > 5. For / = 4, fl7.43|) holds for n > 9; for 
/ = 3, it holds for n > 7. For Z = 2, ( |7.43|) holds for n > 5, and for Z = 1, 
it holds for n > 4. The remaining possibilities with n > 21 are ruled out by 
the linear programming bounds of section [7^. On the other hand, if I > n/2, 
then k < n — Z < n/2. For n > 13, the quantum Hamming bound is less 
restrictive than this, so in conjunction with the linear programming bounds, we 
can conclude that there are no distance three degenerate stabilizer codes that 
exceed the quantum Hamming bound. 

We can make a similar argument for codes to correct two errors. Now let 
D be generated by the operators of weight four or less in 5*. There must be 
at least n — 41 qubits that are unaffected by operators in D. All the possible 
weight one and two errors on those qubits give orthogonal states, so 



1 + 3(n - 40 + H( n _ 4Z)(n - 4Z - 1) 



3 9 

1 - -n + -n 2 + 6/(1 + 12/ - 6n) 



n—l 



< 2 



2 l < 2 n ~ k . 



The quantum Hamming bound will still hold if 
3 9 



1 - |n + ^n 2 + 6/(1 + 12/ - 6n) 



6/(6n- 12/- 1) 



l-3?i/2 + 9n 2 /2 



2 l l--n+-n 2 
2 2 



2 l > 1. 



(7.44) 
(7.45) 

(7.46) 
(7.47) 



Now, Z(6n-12/ - 1) = -12[/ 2 - (6n - 1)//12] is maximized for I = (6n-l)/24. 
That means ( 7.47 ) will be satisfied when 



(6n - l) 2 



12n + 36n 2 
7 



12n + 36n 2 



2' > 1 



■T > 1 



7 • 2^ 2 > 9n 2 - 3n + 2. 



(7.48) 

(7.49) 
(7.50) 



If this is true, the code will satisfy the quantum Hamming bound. If it is not 
true, then 



/ < 2-log 2 7 + log 2 (9n 2 -3n + 2) 
< 3 + 2 log 2 n. 



(7.51) 
(7.52) 
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Then l(6n — 121 — 1) < 6nl < 6n(3 + 2 log 2 n), so equation (7.47) will again be 
satisfied when 



1 - 



6n(3 + 2 log 2 n) 



However, for n > 30, 



1 -3n/2 + 9n 2 /2 
6n(3 + 2 log 2 n 



2 1 > 1. 



l-3?i/2 + 9n 2 /2 



< 0.58, 



(7.53) 



(7.54) 



so (7.47) will be satisfied for any I with 1 < I < n/4 in the regime of interest. 
When 1 = 1, (|7.47|) becomes 



1 - 



6(6n- 13) 
l-3n/2 + 9n 2 /2 



> 1/2. 



However, for n > 30, 



6(6n- 13) 



so (7.47) is satisfied for I 



1 - 3n/2 ^ 
- 1 as well. 



9n 2 /2 



< 0.26, 



(7.55) 



(7.56) 



Therefore, we are left with I > n/4. Again, this implies that k < n — I < 
3n/4. This is at least as restrictive than the quantum Hamming bound for 
n > 52. For n = 31, the quantum Hamming bound says k < n — 13. Therefore, 
for 31 < n < 51, the only remaining region of interest, the code must have 
I < n/A + 5 to violate the quantum Hamming bound. The only possibility for 
I > n/4 + 4 is I = 12, n = 31. Assume for the moment that I < n/4 + 4. Then 
there are at least n— 16 qubits in the code that are affected by at most one of the 
generators of D. This is more than I + 3, so either at least two of the generators 
of D must each affect two qubits that are fixed by all of the other generators, or 
one generator fixes four qubits that are unaffected by all of the other generators. 
The second case will be more restrictive to the code than the first one, so I will 
assume the first case holds. Assume without loss of generality that the two 
generators are M;_i and Mi. Then errors on the four qubits affected only by 
these generators leave the codewords within the subspace fixed by D', the group 
generated by M\, . . . , M;_ 2 . There are 67 errors of weight zero, one and two on 
the four qubits, so 



67-2 fc < 2"~ (i ~ 2) 
k < n — I — 5. 



(7.57) 
(7.58) 



This is at least as restrictive as the quantum Hamming bound for any n between 
31 and 51. 

That leaves the case / = 12, n = 31. Even in this case, there must be 
at least fourteen qubits that are affected by at most one of the generators of 
D. As before, this is enough to ensure that we can pick two generators of D 
that will together act on four qubits unaffected by any of the other generators. 
Again, k < n — / — 5, which is more restrictive than the quantum Hamming 
bound. Therefore, there are no two-error-correcting degenerate stabilizer codes 
exceeding the quantum Hamming bound. 
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The methods of this section could be adapted and perhaps applied to codes 
correcting three or more errors, but it gets more difficult for each additional 
error, since the cases with I > n/(2t) must be treated on a special basis, and 
the range of n for which this could violate the quantum Hamming bound grows 
rapidly with t. Eventually, it might well be true that some code with enough 
degeneracies does violate the quantum Hamming bound. 

Even though we cannot rule out the possibility of a sufficiently large de- 
generate code violating the quantum Hamming bound, we can still set a less 
restrictive bound on degenerate stabilizer codes by constructing a classical code 
from the quantum code |Q. Since bounds on the efficiencies of classical codes 
are known, we can therefore get bounds on the possible parameters of quantum 
codes. 

To produce a clas sical code from a quantum code, first put the code in 
standard form, as per (4.3). In particular, note the r x k matrix A2. r < n — k, 
but by performing single qubit rotations from N(Q), we can always convert one 
generator to the product of cr^'s, so we can ensure that r < n — k — 1. If we 
look at the classical code C with k x (r + k) generator matrix (A^\I) : then C 
encodes k bits in at most n—1 bits. If the original quantum code could correct 
t quantum errors, it turns out that the classical code C can correct t classical 
bit flip errors, whether the quantum code was degenerate or nondegenerate. 
Therefore, the existence of an [n, k, d\ quantum code implies that an [n — 1, k, d\ 
classical code exists. 



7.4 Error-Correcting Codes and Entanglement 
Purification Protocols 

Before discussing bounds on the channel capacity, I will discuss another way 
of looking at quantum codes that is sometimes helpful for thinking about the 
channel capacity. Consider the situation where Alice prepares a number of EPR 
pairs and sends one member of the pair to Bob. In general, both the qubits 
that Alice keeps and the qubits she sends to Bob may be subject to errors and 
decoherence. This means that Alice and Bob will share a number of imperfect 
pairs. If Alice attempts to tclcport a state using these imperfect EPR pairs, 
for instance, the state that Bob receives will be incorrect. Alice and Bob wish 
to perform some local operations on their halves of the imperfect pairs so that 
they are left with a smaller number of perfect pairs (or at least better ones). 
A protocol to do this is called an entanglement purification protocol (or EPP) 

ED- 

Depending on the situation, Bob and Alice may or may not be allowed to 
communicate with each other and perform operations conditioned on the results 
of measurements by the other one. If both Bob and Alice can communicate with 
each other via classical communication channels, the possible protocols they can 
implement are called two-way error purification protocols (or 2-EPPs). If Bob 
can only receive classical information (as well as qubits) from Alice, but not 
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transmit, then Bob and Alice are restricted to using one-way error purification 
protocols (or 1-EPPs). In principle, there is another possibility. Bob and Alice 
might not be able to communicate classically at all. However, it turns out that 
the protocols available for them in this case are equivalent to the 1-EPPs. On 
the other hand, it is known that in some circumstances, 2-EPPs allow more 
good pairs to be purified than 1-EPPs do [jl7j . 

One remarkable fact about 1-EPPs is that they are equivalent to quantum 
error-correcting codes. Suppose we have a quantum code. We can make a 1- 
EPP out of it as follows: Alice encodes the qubits she is going to send to Bob 
using the code, then Bob corrects and decodes. The encoded qubits that are 
thus preserved in the channel retain their entanglement with the qubits Alice 
kept, and thus form part of a good EPR pair. The number of good pairs is just 
equal to the number of encoded qubits. 

Conversely, suppose we have a 1-EPP that distills k good pairs from n noisy 
pairs and we wish to make a quantum code. In this case Alice is the encoder and 
Bob is the decoder for the code. Alice creates n EPR pairs and sends them to 
Bob, then performs her half of the 1-EPP. Since she cannot receive transmissions 
from Bob, she does not need to wait until Bob receives the qubits to do this. 
This is why a quantum code is equivalent to a 1-EPP and not a 2-EPP. After 
she has performed her half of the purification protocol, sending any necessary 
classical information, she takes the k qubits she wishes to protect and performs 
her half of the teleportation protocol using her half of what will be the k good 
pairs. Again, she sends the classical information about the measurement results 
to Bob. Bob now receives the qubits, plus all the classical information. He 
completes the purification protocol, purifying k good pairs. Since they are good 
EPR pairs, when he then completes the teleportation protocol, the resulting 
state is the correct one, and the whole process acts like a code encoding k 
qubits in n qubits. 

7.5 Capacity of the Erasure Channel 

Most quantum channels are very difficult to analyze. However, the channel 
capacity is known for at least one simple channel of interest. The erasure channel 
is the channel for which every qubit sent through the channel has some chance 
p of being totally randomized. However, when this happens, we always know on 
which qubit it occurred. The capacity of the erasure channel for both quantum 
codes and 2-EPPs is straightforward to calculate [[39) . 

The capacity for 2-EPPs is particularly straightforward. If Alice sends n 
EPR pairs through the channel, pn of them will be destroyed, but (1 — p)n will 
remain intact. Furthermore, Bob will know which pairs remain intact, so he 
tells Alice and they discard the useless pairs. This achieves a rate of 1 — p. 
Clearly, it is impossible to do better than this. This means that the capacity 
for a 2-EPP is just 1 - p. 

With a 1-EPP or quantum code, we cannot do as well, because Bob cannot 
tell Alice which pairs she should keep and which she should throw away. In fact, 
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we can set an upper bound on the capacity of 1 — 2p. Suppose the erasure rate 
of p in the channel is actually caused by Charlie, who steals any given qubit 
with probability p, replaces any stolen qubits with random ones, and then tells 
Bob which qubits he stole. When p = 1/2, Bob has exactly the same number 
of valid pairs as Charlie. If there were any operations Alice could make without 
consulting Bob that enabled him to purify even a single valid pair, Charlie could 
do the same thing as Bob, also giving a valid pair. Now when Alice attempts 
to teleport something to Bob, she is also teleporting it to Charlie. This would 
allow the cloning of a quantum state. Therefore, the rate for p > 1/2 is zero. 
For p < 1/2, we can imagine Alice somehow knows n(l — 2p) of the pairs that 
will not be stolen by Charlie. The remaining 2pn pairs she is uncertain about. 
Of them, pn will be stolen by Charlie, again leaving him with the same number 
of good pairs from this set as Bob has. If Alice attempts to purify more than 
n(l — 2p) pairs with Bob, she will therefore also be purifying pairs with Charlie, 
again leading to state cloning. Therefore, the capacity is bounded above by 
1 - 2p. 

This is, in fact, the actual achievable capacity for this channel. Suppose we 
take a random Abelian subgroup of Q n with n — k generators. This subgroup 
will act as the stabilizer S of a code. If we encode k qubits using this code, and 
then send them through the erasure channel, for large n, with high probability, 
pn known qubits will have been randomized. We need to distinguish between 
the A pn possible errors on these qubits. Since the error operators are all on the 
same pn qubits, there are again 4P n products of these operators. If measure 
one of these products anticommute with some element of S, then we will be 
able to correct the errors and decode the k qubits, with fidelity approaching one 
for large n. Since the generators are chosen randomly, each one will commute 
with half of the possible operators of weight pn and anticommute with half 
of the possible operators. The different generators commute and anticommute 
with operators independently, so the number of operators that commute with 
all n — k generators is 



where r is the rate: k = m. As long as r < 1 — 2p, the chance of not being 
able to distinguish all the likely errors goes to zero as n — > oo. Therefore, a 
random stabilizer code can give us rate 1 — 2p. Since this coincides with the 
upper bound on the capacity, it is the actual capacity of the erasure channel. 

7.6 Capacity of the Depolarizing Channel 

The depolarizing channel is a very natural channel to consider. In this channel, 
with probability 1 — p, each qubit is left alone. In addition, there are equal 
probabilities p/3 that a~ x , o~ y , or a z affects the qubit. We can apply similar 
methods to the depolarizing channel as with the erasure channel to place upper 
and lower bounds on its capacity. However, currently these bounds do not meet, 
so the actual capacity of the depolarizing channel is unknown. 



4 pr 72' 




(r-l+2p)n 



(7.59) 
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The depolarizing channel can also simulated by imagining Charlie is ran- 
domly stealing some qubits from the channel. If Charlie steals a qubit with 
probability q and replaces it with a random qubit (not telling Bob which one 
was stolen), there is still a 1/4 chance that Charlie happens to replace the stolen 
qubit with one in the same state. There is only a chance q/A of Charlie applying 
each of a x , cr y , and a z . Therefore, this situation corresponds to the depolariz- 
ing channel with p = 3g/4. We can make a cloning argument just as with the 
erasure channel to set an upper bound on the capacity. Again we find that the 
capacity is limited by 1 — 2q = 1 — 8p/3. When p > 3/8, the rate of transmission 
is necessarily zero. 

Actually, we can set a tighter upper bound than this. Randomly stealing 
qubits is not the best eavesdropping method available to Charlie that will look 
like the depolarizing channel. The best eavesdropping method actually allows 
him to produce the same state as Bob whenever p > 1/4 |30). This means 
that the rate is limited to 1 — Ap. This is the asymptotic form of the Knill- 
Laflamme bound, which was derived for codes with a fixed minimum distance 
in section fTlj 

We can set a lower bound for the achievable rate by again considering the 
rate for a random stabilizer code. If we encode k qubits in n qubits using a 
random stabilizer S, the expected number of errors is pn. We need measure 
one of the errors to be distinguishable from each other. The errors E and F 
are distinguishable if E^ F anticommutes with some elements of S, and are not 
if they do not. The typical product E^F actually does not have weight 2pn. 
There is a chance p 2 that E and F will both have nontrivial action on a given 
qubit. If they act as different Pauli matrices, the product will still act on that 
qubit. If they act as the same Pauli matrix, the product will not act on that 
qubit at all. The probability of having both act as the same Pauli matrix is 
p 2 /3. Therefore, the expected length of the product E^F is [2p — Ap 2 /3)n. Let 
x = 2p - Ap 2 /3. 

Let the number of errors of weight w be N(w). Then the number of different 
products of weight xn is N(xn), and therefore the number of typical products 
that commute with everything in S is N (xn) / 2 n ~ k . Now, there are N(pn) likely 
errors, so the number of ways we can pair them into products is N(pn)[N(pn) — 
l]/2. This means that the number of ways of getting any given operator O of 
weight xn is 



For each of the pairs that gives one of the N(xn)/2 n ~ k products that commute 
with S, we must remove one of the errors in the pair from the group of likely 
errors. Therefore, we must remove 




(7.60) 




(7.61) 



errors. We want to remove only measure zero of the errors, so we wish this 
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number to be small compared to N(pn) for large n. Thus, 

(7.62) 
(7.63) 

f (pn) = l-plog 2 3-JJ(p). (7.64) 



A/-(pn)/2"- fe+1 




1 


N(pn) 






k/n 


< 


1- - lo 



This is just the quantum Hamming bound (7.3). In other words, a random code 
saturates the quantum Hamming bound. 

However, the quantum Hamming bound only limits the efficiency of non- 
degenerate codes. The typical element of a random stabilizer will have weight 
3n/4, which is much larger than pn for any p where the rate could possibly 
be nonzero. Therefore, a random code will have a negligable number of de- 
generate errors, and the quantum Hamming bound will still apply. However, if 
we choose the stabilizer to be of a restricted form rather than totally random, 
we can choose it to have very many degeneracies, and the quantum Hamming 
bound may be exceeded Q , although existing codes only allow us to exceed the 
rate of a random code by a very small amount. Shor and Smolin showed that 
by concatenating a random code with a simple repetition code (|0) becomes the 
tensor product of |0)'s and |1) becomes the tensor product of |l)'s), the rate of 
the code is improved slightly near the zero-rate limit. The optimum block size 
for repetition turns out to be five. 

We can still set an upper bound on the efficiency of a degenerate stabilizer 
code using similar arguments to those that gave us the capacity of a random 
stabilizer code. Note that this upper bound does not necessarily apply to all 
codes, so it may not be a strict upper bound on the capacity. However, non- 
stabilizer codes are very difficult to work with, so it does provide a practical 
upper bound on the capacity. 

To give this bound, assume that every element of S actually has weight 
xn. This bound is unlikely to be achievable, since the product of two oper- 
ators of weight xn will only rarely have weight xn again. There are at least 
N(xn)/2 n ~ k operators of weight n that commute with S, but 2™~ fe of them are 
in S. Therefore, in the best case, there are only N{xn)/2 n ~ k — 2 n ~ k operators 
that can potentially cause a problem. In the limit where n and k — rn are 
both large, either N{xn)/2 n ~ k will dominate the number of troublesome oper- 
ators, or N(xn)/2 n - k < 2™- fc . In the first case, the calculation goes through 
as for a completely random stabilizer, giving us a capacity only at the quantum 
Hamming bound. In the second case, 

N(xn) < 2 2 ("- fe ) (7.65) 

r = k/n < l-^log 2 AT(xn) = l-|log 2 3-iff(x). (7.66) 

Since x = 2p — Ap 2 /3, this is higher than the quantum Hamming bound. Equa- 



tion (7.66) gives an upper bound on the capacity of the depolarizing channel 



achievable using stabilizer codes. It is shown in figure 7.1 along with the Knill 



Laflamme bound and the quantum Hamming bound. Cleve has also proved a 
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Figure 7.1: The quantum Hamming bound (dashed), the Knill-Laflamme bound 
(dotted), and the bound from equation (7.66) (solid). 



bound on the capacity achievable using degenerate stabilizer codes [Q, but it 
is slightly worse than (7.66) everywhere in the region of interest, so it is not 
shown in the figure. 
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Chapter 8 

Examples of Stabilizer 
Codes 



There are many known stabilizer codes (Tg, jO], \LQ |l§ |T|, |g, |lj ||, ||, 



26 27 



( ^ |3J, |^ |3J, |^ ^2j. I will not attempt to list them all here, 
but will instead concentrate on a few interesting individual codes and classes 
of codes. In a number of cases, I will not just describe the stabilizers of the 
codes, but will also discuss the normalizers and automorphism groups of the 
stabilizers, since these are important to realizing fault-tolerant computation in 
the most efficient possible way. 



8.1 Distance Two Codes 

For even n, there is always an [n,n — 2,2] code. The stabilizer S has two 
generators, one the product of all n cr^'s and one the product of all the ct 2 's. 
For even n, these commute. N(S) consists of tensor products in Q that contain 
an even number of cr^'s, an even number of <7 y 's, and an even number of cr 2 's. 
We can write 

Xi = CFxl&x{i+l) (8-1) 

%i = <rz(i+l)Czni (8-2) 

for i = 1, . . . , n — 2. 

The automorphism group -4(5) contains all possible permutations of the 
qubits and the Hadamard rotation R applied to all n qubits at once. If n 
is a multiple of four, any single-qubit operation in N(Q) applied to all the 
qubits gives an element of A(S). The order of A(S) is thus either 2n! or 6n!. 
Swapping qubit i with qubit j switches the (i — l)th encoded qubit with the 
(j — l)th encoded qubit (for 1 < i,j < n). Swapping qubit 1 with qubit i + 1 
(i — 1, . . . , n — 2) transforms 

Xi — > Xi 
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Z, — > Z\Zi---Z n -i (8-3) 
Zj -> Zj (i^i). 

Similarly, swapping qubit n with qubit i + 1 (i = 1, . . . , n — 2) transforms 

— * X1X2 • • • I„-2 

X, -> X, (i ^ j) 

2, -> Z* (8.4) 
Zj -► ZiZ, (i^i). 

Swapping the first qubit with the nth qubit performs the transformation 

Xi — > .Xi • • • • • • X n _2 

Zi — > Zi • • • Zi-iZi+i • • ■ Z n _2- (8-5) 

Performing i? on every qubit performs the same transformation as swapping 
the first and nth qubits, but also performs R on every encoded qubit. For n a 
multiple of four, performing P on every qubit performs the following operation: 

Xi — * —XiZ\-"Zi—\Zi+\'--Z n —2 

Zi -» Z*. (8.6) 

Because these codes are of the CSS form, a CNOT applied to every qubit 
transversally between two blocks is also a valid fault-tolerant operation, and 
performs CNOTs between the corresponding encoded qubits. 

The case of n = 4, the smallest distance two code, is of particular interest. 



The code from figure 3.5 can be converted into the form of the codes currently 
under consideration using single-qubit rotations, although the X and Z oper- 
ators will need to redefined. It can be used to detect a single error Q or to 
correct a single erasure In this case, 

X\ = a x \<j X 2 

X2 = <Jxl&x3 

Zi = er 22 er 2 4 (8.7) 

Z2 = Oz3(7 z 4. 

Switching the second and third qubits or switching the first and fourth qubits 
both swap the two encoded qubits. Swapping the first and second qubits or the 
third and fourth qubits produces the transformation 

Xi -» Xi 

X2 — > X1X2 

~Z X ~Z{Z2 (8.8) 

Z2 — ► Z2. 
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This is just a CNOT from the second encoded qubit to the first encoded qubit. 
Similarly, swapping the first and third qubits or the second and fourth qubits 
performs a CNOT from the first encoded qubit to the second encoded qubit. The 
transversal Hadamard rotation in this case performs the Hadamard rotations 
on both qubits and switches them. Applying P to all four qubits performs the 
gate 

—X1Z2 

Zi (8.9) 

We can recognize this as the encoded conditional sign gate followed by an en- 
coded O z \O z 2- 

A more extensive discussion of the properties of distance two codes (and a 
few codes of greater distances) appears in [|2| . 




8.2 The Five-Qubit Code 

The five-qubit code is the shortest possible quantum code to correct one error 
and is therefore of immense interest |l7], |24|. Its stabilizer is given in table 3.2 



Recall that the stabilizer is simply generated by cyclic permutations of a x ®a z 
a z ® a x ® I- There are five cyclic permutations of this, but only four produce 
independent generators. The stabilizer has sixteen elements: the identity, and 
the 3x5 cyclic permutations of a x ® a z ® a z ® a x ® /, a y ® a x ® a x ® a y ® /, 
and a z ® a y ® a y ® cr z ® I. X is just the tensor product of five a x s and Z is 
the tensor product of the five a z 's. 

As I noted in section [TJ, the five-qubit code is a linear GF(4) code. There- 
fore, the operation 

T '. u x — ► o y , a z -> a x (8.10) 

applied transversally is a valid fault-tolerant operation and performs an encoded 
version of itself. We can use this operation to derive a valid three-qubit operation 
for the five-qubit code: 

<J X ® I <g> I — > a x ® o y ® a z 
I ® o x ® I — > a y ® a x ® a z 

I®I®a x — > a x ® a x ® a x (8-11) 
<j z ® I ® I — > a z ® a x <g> a v 



I ® o z ® I — > a x ® o z 
I ®I ®o z — > a z ® a z ® a z 



'11 



We can, of course, permute the qubits on the right and apply T or T 2 to any or 
all of them and still get a valid three-qubit operation. 
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Using measurements and this three-qubit operation, we can generate directly 
a number of additional one- and two-qubit operations. We can always get such 
gates using the protocol described in section 5.5, but it may be more efficient to 
get some gates using this three-qubit operation. Suppose we place the data qubit 
in the third place and prepare the first two qubits in encoded |0) states. Then 
apply the three-qubit operation and measure a y on the first two qubits. The 
effect is to perform a Hadamard rotation R on the data qubit. Alternatively, 
prepare the first two qubits in +1 eigenstates of a x , apply the three-qubit gate, 
and measure <j z on the first two qubits. This performs P on the data qubit. By 
preparing a single ancilla qubit, applying the three-qubit operation, and making 
a single measurement, we can also get a variety of two-qubit operations. 



8.3 A Class of Distance Three Codes 

The eight-qubit code of table |3.3| is just one of a class of codes with parameters 
[2 J , 2 J — j — 2, 3] pl[ . Note that according the quantum Hamming bound, this 
is the maximal number of encoded qubits for n = 2 J , d = 3. These codes are 
related to the classical Reed-Muller codes ^8|, but are more efficient than CSS 
codes formed from the classical Reed-Muller codes. Like the classical Reed- 
Muller codes, the codes described in this section allow us to efficiently compute 
the actual error occuring from the measured error syndrome. 

The first two generators of these codes are always the same. One is the 
product of 2 J a x s and the second is the product of 2 J cr z 's. We will call these 
generators Mx and Mz, and the remaining j generators will be Mi through Mj. 
The stabilizers of these codes always include the distance two codes discussed 



in section S.l. This is convenient when correcting errors — we can measure the 
first two generators and use them to detect whether any error has occurred. If 
not, we do not need to go any further. 

It will be convenient to construct the codes by describing the error syndromes 
of the 3n possible one-qubit errors. I will show that they are all distinct and 
then that the generators that give those error syndromes all commute. For these 
codes, the error syndrome f(E) for error E is a (j + 2)-bit number. Recall that 
each bit corresponds to a generator of S, and the ith bit is iff E commutes 
with generator Mi. f(E) is a group homomorphism from Q to (Z2)"' +2 . 

Because of the form of the first two generators, the first two bits of f(a X i) 
are always 01, the first two bits of /(<x zi ) are always 10, and the first two bits 
of f{<J y i) are always 11, as they must be to preserve the group structure of Q. 
For the remaining bits of the error syndrome, we will number the qubits from 
to n — 1 and write the number in base two. Then 

f(<J xl ) = 01 ©z (8.12) 
f(a zi ) = lOScrfi) (8.13) 
f(<r yi ) = 11 9 (i + <r(i)). (8.14) 



The function <j(i) is some as yet undefined additive group automorphism on 
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Table 8.1: The stabilizer for a [16, 10, 3] code. 



(Z2) J . We will be able to completely describe it by defining its action on ... 01, 
0...010, 10...0. 

For this to give a distance three code, the error syndrome must have the 
property that f(E) ^ for any weight two operator E 6 Q. By including the 
stabilizer of a distance two code, we have already insured that any weight one 
operator has non-zero error syndrome. We can immediately see that f(E) ^ 
unless E is the product of two Pauli matrices of the same type. Therefore, we 
need to consider 

00©(Z + to) (8.15) 
00 @a{l + m) (8.16) 
00 + to) +o(l + m), (8.17) 

for I to. The second and third equations follow because o is a group homo- 
morphism. Since i — I + m can be anything but 0, o(l + to) will not be either, 
and we need only choose o so that o(i) ^ i for any i ^ 0. 

The actual function er we want to use will depend on whether j is even or 
odd. For even j, consider the following function a: 



o(0. 


.0001) = 


11 . 


..11 




o(0. 


.0010) = 


0. . 


.001 




o(0. 


.0100) = 


0. . 


.010 


(8.18) 



cr(1000...0) = 010... 0. 

Then clearly a(i) = i/2 for any nonzero i ending in 0. If i does end in 1, for a(i) 
to end in 1 also, the previous bit must have been 0, which means that the bit 
before that must have been 1, and so on. Therefore, the only possible number 
for which i = o(i) is i = 010 . . . 101. Because j is even, the first bit must be 0. 
But o{l) always begins in 1 for any I ending in 1, so even for this particular i, 
o(i) 7^ i. Therefore, the error syndrome produces a dis tanc e three code. The 
smallest case is a [16, 10, 3] code, which is given in table |8.l[ 

We do still need to verify that it is an actual code by verifying that there are 
commuting generators that give these error syndromes. The first two generators 
Mx and Mz will always commute with the other j generators, since f(o X i) and 



f(OxlOxrn) = 

f(o z io zm ) = 

}{OylO ym ) = 



CHAPTER 8. EXAMPLES OF STABILIZER CODES 



92 



f(&zi) each have a in the rth position for n/2 z's and a 1 in the rth position 
for n/2 i's. When the rth bit of f(cr X i) is and the rth bit of f(<r Z i) is 1, then 
the rth generator is the tensor product of a xi with something else (thus, this 
generator commutes with <r x j and anticommutcs with <J z i). Other combinations 
will produce /, a v i, or a Z i, and we can determine the complete form of M r in 
this way. 

We need only check that M r and M s commute. Let f r (E) be the (r + 2)th 
bit of f(E), that is, the bit corresponding to M r . I assume without loss of 
generality that s > r. The binary matrix representation of S is closely related 
to the error syndrome, and M r and M s commute iff 

n 

]T (f r (a xi )f B (a xi ) + f r (a xi )f a (a xi )) = 0. (8.19) 

i=0 

There are a few possible cases to consider: 

• j > s > r + 1 > 2: In this case, f s (a Z i) is equal to the sum of the jth bit 
of i and the (s — l)th bit and f r (<J Z i) is the sum of the jth bit of i and the 
(r — l)th bit. On the other hand, f r (<J X i) is just equal to the rth bit of i 
and f s (<J Z i) is equal to the sth bit of i. The jth, (r — l)th, and (s — l)th 
bits are distinct from bits r and s. Therefore, the fr{v X i)fs{& Z i) term 
contributes to the sum when the rth bit of i is 1 and the jth and (s — l)th 
bits of i are different. This is true for n/4 values of i. The f r (& Z i)fs(v X i) 
term similarly contributes to the sum for n/4 i's. Since n/4 + n/4 is even, 
M r and M s commute. 

• j > s > r + 1 = 2: In this case, f s (<J Z i) is still equal to the sum of the 
jth bit of i and the (s — l)th bit, but f r (cr Z i) is just equal to the jth bit 
of i. However, both the f r (<y X i)f s (a Z i) and the fr(&zi)fs(Pxi) terms still 
contribute to the sum for n/4 i's, so M r and M s still commute. 

• j = s > r + 1 > 2: Both f s (cr z i) and f r (& Z i) are given as in the first case. 
.fr{v X i)fs{v Z i) still contributes to n/4 terms in the sum. Now, however, 
fr(&zi)fs(&xi) can only contribute when the jth bit of i is 1. Since we also 
need f r (<J Z i) = 1, this term only contributes when the jth bit of i is 1 and 
the (r — l)th bit is 0. This still contributes to n/4 terms in the sum, so 
M r and M s again commute. 

• j>s = r+ l>2: Now, the (s — l)th bit is equal to the rth bit. 
That means f r (<J X i)fs(^ Z i) only contributes when the rth bit of i is 1 and 
the jth bit of i is 0. This contributes to n/4 terms in the sum, as does 
fr(p Z i)fs(v X i), so M r and M s commute in this case as well. 

• j = s = r + 1 > 2: This is a combination of the previous two cases. 
fr{Gxi)fs{& Z i) only contributes when the rth bit of i is 1 and the jth bit 
of i is and f r {o' Z i)fs{o' X i) contributes when the jth bit of i is 1 and the 
(r — l)th bit is 0. Again, this is an even number of contributing terms, so 
M r and M s commute. 
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• j > s = r + 1 = 2: fri&zi) is again equal to the jth bit of i. However, this 
does not affect f r {o X i)fs(ozi), which contributes to n/A terms in the sum, 
as in the previous two cases. It does affect frio'zilfsi^xi)} but this term 
still contributes to n/A terms, so M r and M s commute. 

• j — s > r + 1 — 2: As before, f r (&xi)fs(&zi) contributes to n/A terms in 
the sum. Now, however, f r {&zi)fs{&xi) contributes whenever the jth bit 
of i is 1. This means it contributes to n/2 terms instead of n/A. Therefore, 
there are a total of 3n/4 contributing terms. However, since j > 3, n/A is 
still even, and Mi and Mj commute too. 

• j = s = r + 1 = 2: Since j > 3, this case is impossible. 
For the case of odd j, we do something very similar. Now let 



(8.20) 



er(0. 


.0001) = 


11 . 


..11 


cr(0. 


.0010) = 


0. . 


.001 


a(0. 


.0100) = 


0. . 


.010 



cr(0100...0) = 001... 
ct(1000... 0) = 101... 1. 



An example of a code using this a is the [8, 3, 3] code given in table |3.3| . In this 
case, if the first bit is 0, the last bit must also be for the first bits of i and 
a(i) to match. However, a(i) is certainly not equal to i for any i with both first 
and last bits 0. If the first bit is 1, the last bit must be in order for the first 
bits of i and a(i) to match. Thus, the second bit must be 0, which means the 
third bit must be 1, and so on. However, since j is odd, this progression would 
mean that the jth bit would have be 1, while we already know it must be 0. 
Therefore, there is no i for which a(i) = i. Again, we have a distance three 
code. 

We again need to check that the generators commute. As for even j, every- 
thing immediately commutes with Mx and Mz- We consider similar cases to 
see if M r and M s commute: 

• j>s>r + l>3: Here, f r (a z i) is the sum of the first, jth, and (r — l)th 
bits of i, and f s (cr z i) is the sum of the first, jth, and (s — l)th bits of i. 
This still leads to both f r (cr x i)f a (a Z i) and fr{?zi)fs{&xi) contributing to 
n/A terms each in the sum, so M r and M s commute. 

• j > s > r + 1 = 3: Now jr{&zi) is just equal to the jth bit of i, as in the 
case j > s > r +1 = 2 for even j. As then, M r and M 8 commute. 

• j>s>r+l = 2: Now f r {<J Z i) is the sum of the first and jth bits of 
i, and f r (cr X i)f s (a Z i) contributes only when the first bit of i is 1 and the 
(s — l)th and jth bits of i agree, but this still contributes to n/A terms in 
the sum, so M r and M s still commute. 
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j = s > r + 1 > 3: In this case, f r (^ Z i)f s (a X i) only contributes when the 
jth bit of i is 1 and the first and (r — l)th bits are the same. This still 
occurs for n/4 i's, so M r and M s commute. 

j > s = r + 1 > 3: Now, f r ((J X i)f s (cr Z i) contributes when the rth bit of 
i is 1 and the first and jth bits are the same. This occurs for n/4 i's, so 
M r and M s commute. 

j = s = r + l>3: f r (cr X i)f s (a Z i) contributes to n/4 terms in the sum, 
as in the previous case, and fr{vzi)fs{&xi) does too, as in the case before 
that. Therefore, M r and M s still commute. 

j > s = r + 1 = 3: As with the previous two cases, f r (<7xi)fs{o' Z i) con- 
tributes to n/4 terms in the sum. f r {<J Z i) is equal to the jth bit of i, so 
fr(& Z i)fs(oxi) contributes only when the sth and jth bits of i are both 1. 
This is still n/4 values of i, so M r and M s again commute. 

j > s = r + 1 = 2: In this case, f s {<T Z i) is the jth bit of i and f r ((T Z i) is 
the sum of the first and jth bits. That means fr(Pxi)fs(&zi) contributes 
when the first and jth bits of i are 1, and fr{<J Z i)fs{vxi) contributes when 
the second bit of i is 1 and the first and jth bits are different. Both of 
these terms therefore contribute to n/4 terms in the sum, so M r and M s 
commute. 

j = s > r + 1 = 3: As usual, f r {c X i)fs{o' Z i) contributes to n/4 terms in 
the sum. f r (u Z i)f s (a X i) contributes whenever the jth bit of i is 1. This 
means it contributes to n/2 terms in the sum, for a total of 3n/4 nonzero 
terms. Again, since j > 3, 3n/4 is even, so M r and M s commute. 

j = s > r + 1 = 2: Now, f r (u X i)f s (a Z i) contributes whenever the first bit 
of i is 1 and the jth and (j — l)th bits agree. This is true for n/4 i's. 
fr(o' Z i)f s (a X i) contributes when the first bit of i is and the jth bit of i 
is 1, which is again true for n/4 i's. Therefore, M r and M s commute. 

j = s = r + 1 = 3: This case only arises for the [8, 3, 3] code, so we can 



just check it by looking at table 3.3. Again, the case j = s = r +1 = 2 
does not arise at all. 

Now I will describe the X and Z operators for these codes. I will choose all 
of the X operators to be of the form a xa cr X i (for some i ^ a) times the product 
of cr z 's. In order to do this, we just need to find a set K of j + 1 a z s (not 
including a za ) for which f(cr z i) over the a z i € K form a spanning set of binary 
vectors in (Z2) 3+1 (skipping Mz, which a z will never anticommute with). Then 
we will be able to pick some operator E that is a product of these a z s so that 
Xi = o xa a X iiE commutes with all the generators of S, and another operator 
E' so that Zi — <j Z i'E' also is in N(S). If we choose the possible values of i' so 
that they do not overlap with the qubits I for which er 2 ; £ K, then {Xi, Zi} = 
and [Xi, Z m ] = for i ^ rn. 
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For even j, K will consist of a z2 i for I = 1, . . . ,j — 1, plus cr 2 o and cr,( n _n 
(recall the qubits are numbered to n — 1). f(a z o) = 10 ... 0, f {a z (n-\)) — 
10 10. . .0, and f(cr z2 i) is 10 followed by the binary representation of 2 i ~ 1 . 
This set K has the desired properties. We pick a = 1. 

For odd j , if will again include a z2 i , but only for I = 1 , . . . j — 2 . The remain- 
ing elements of K will be a z0 , cr z(20 -i )+1) , and <7 2 („_ 2 ). Now, /(^( 2 W-i)+i)) = 
10 © 010 ... 0, and /(ov„_ 2 )) = 10 ® 10 ... 0, so again if will have the desired 
property. We again pick a — 1. Note that for the eight-qubit cod e, this will 
actually give us a different definition of X± and Zi than in table 3.3 . 

I will conclude this section with a brief discussion of the automorphism 
groups of these codes. There will not generally be a simple transversal operation 
in A(S) for one of these codes, but they have a number of symmetries when 
we allow permutations of the qubits. One simple but large class of symmetries 
switches qubit i with qubit i + I, where the addition is bitwise binary. For 
instance, we might swap the first n/2 qubits with the last n/2 qubits, or the 
first n/4 qubits with the second n/4 and the third n/4 with the last n/4. The 
effect of this swap is to add 1 to any bit r of f(a X i) (for all i) where I is 1 in the 
rth bit. This much is equivalent to multiplying M r by Mz- We also add 1 to 
any bit r of f(<r z i) (for all i) where a(l) is 1 in the rth bit. This is equivalent 
to multiplying M r by Mx- Whether we multiply by Mx, Mz, or both, the 
product is still in S, so the operation preserves S and is a valid fault-tolerant 
operation. There may be other symmetries of these codes, as well. 



8.4 Perfect One-Error-Correcting Codes 

A perfect quantum code is a nondegenerate code for which the inequality of the 
quantum Hamming bound becomes an equality. For one-error-correcting codes, 
that means (1 + 3n)2 k — 2™. The possibility of a perfect code therefore exists 
whenever 1 + 3n is a power of two (up to 2"). For instance, the five-qubit code 
is a perfect code. 1 -I- 3n will be a power of two iff n = (2 2 - 7 — l)/3 for some j. 
Therefore there could be perfect codes for n = 5, n — 21, n = 85, and so on, 
with parameters [(2 2j — l)/3, (2 2j — l)/3— 2j, 3]. In fact, perfect codes do exist 
for all these parameters. 

One construction of these codes uses the Hamming codes over GF(4) p6| . 
Another construction is to paste together one of the codes from the previous 
section with an earlier perfect code. The stabilizer S\ of any code from sec- 
tion |S.3| contains the stabilizer R\ = {I,Mx,Mz,MxMz} for a distance two 
code. To make the perfect code for j > 3, let Si be the stabilizer for the 
[2 2j - 2 , 2 2 i-2 _ 2j ; 3] coc l ej and S 2 be the stabilizer for the perfect code for j — 1, 
with parameters [(2 2 J- 2 - l)/3, (2 2 ^ 2 - l)/3 - 2j + 2, 3]. For j = 2, S 2 is the 
stabilizer for the five-qubit code. Then using trivial R 2 (which still has distance 
one), the pasting construction of section |3.5| gives us a new code of distance 
three. The total number of qubits used by the code is 



2 2j-2 + ( 2 2j-2 _ !)/ 3 = ( 4 2 2 ^ 2 - l)/3 = (2 2j - l)/3. (8.21) 
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It encodes (2 2j — l)/3 — 2j qubits, and therefore is the perfect code for j. 

8.5 A Class of Distance Four Codes 

We can extend the stabilizers of the codes from section ^3] to get distance four 
codes. The parameters of these distance four codes will be [2 J , V — 2j — 2,4]. 
The first two generators of S will again be Mx and Mz- The next j generators 



of S are the generators Mi through Mj from section |8.3| , so S includes the 
stabilizer for a distance three code. The last j generators of S are N% = RMiR 
for i = where R is applied to all 2 J qubits. As with the codes of 

section 8.2 , the error occuring for these codes can be efficiently determined 
from the error syndrome. 

We can summarize this by writing the error syndromes for a X i and a Z i\ 

f{<r xi ) = Ol0i®<r(i) (8.22) 
f(cr zi ) = 10eff(*)©». (8.23) 

Since S includes the stabilizer of a distance three code, it automatically has 
distance at least three. We need to check that f(E) ^ for any weight three 
operator E. The only form of an operator E for which the first two bits of f(E) 
could be 00 is E = <y xa a y ba zc . Then 

f(E) = 00 © (a + tr(6) + b + a(c)) (cr(a) + b + a{b) + c) (8.24) 
= 00® (a + b + a{b + c))®{b + c + a(a + b)). (8.25) 

If r = a + b and s = b + c, then f(E) is nonzero as long as r ^ cr(s) or s ^ cr(r). 
This means that we need 

s ct(ct(s)) = a 2 {s) (8.26) 

for all nonzero s (when r = s = 0, E = I). To see that this is true, note that 
for even j, 

cr 2 (0...0001) = 10... 00 
cr 2 (0...0010) = 11... 11 

ct 2 (0...0100) = 0...001 (8.27) 



cr 2 (1000...0) = 001...0. 

If s has a in the next-to-last bit, it cannot have tr 2 (s) = s unless s = 0. If 
s has a 1 in the next-to-last bit, it must have a for the fourth- from-the-last 
bit, and so on. If j is a multiple of four, we find that the first bit must be a 0, 
which means that the last bit of s must be a 1. This in turn implies that the 
third-from-the-last bit is 0, and so on until we reach the second bit of s, which 
must be 0, so s = 001100 ... 11. However, the second bit of <r 2 (s) is 1 because 
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Table 8.2: The stabilizer for a [16,6,4] code. 



the next-to-last bit is. Therefore, o(s) ^ s in this case. If j is even, but not a 
multiple of four, the first bit of s must be 1, which means that the last bit is 
0. Again we follow the chain of logic back to the second bit of s and again find 
that it must be 0, again giving a contradiction. Therefore o 2 (s) ^ s for any 
nonze ro s for any even j. An example for even j is the [16,6,4] code given in 
table |J. 

If j is odd, 



(T 2 (0...0001) 


= 0111. 


. .11 




cr 2 (0...0010) 


= 1111. 


. .11 




cr 2 (0... 0100) 


= 000 . . 


.001 




er 2 (0...1000) 


= 000 . . 


.010 


(8.28) 


o 2 (010... 00) 


= 0001 . 


. .00 




cr 2 (1000...0) 


= 0101. 


. .11. 





In order to have o 2 (s) = s, we cannot have the first bit and last two bits of s all 0. 
If the first bit of s is 1, then the next-to-last bit of s must also be 1. Then if the 
last bit is 0, the third- from-the-last bit must be and the fourth- from-thc-last 
bit must be 1. Also, the second bit is and the third bit is 1. After the third bit, 
they must continue to alternate and 1 until the next-to-last bit. This means 
odd numbered bits are 1 and even numbered bits are 0. However, the fourth- 
from-the-last bit is an even numbered bit, giving a contradiction. Therefore, if 
the first bit of s is 1, the last two bits must both be 1 also. That means the 
third-from-the-last and fourth-from-the-last bits must both be 0. However, it 
also means that the second bit of s is 1 and the third bit of s is 0. The fourth 
bit is again, but the fifth bit is 1, and after that they alternate until the last 
two bits. This contradicts the fact that the third- and fourth-from-the-last bits 
must both be 0. 

That leaves the possibility that the first bit of s is 0. Then the next-to-last 
bit is too, so the last bit must be 1. That means the third-from-the-last bit 
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Table 8.3: The stabilizer for the [8,0,4] code. 



is and the fourth- from-the-last bit is 1. Also, the second and third bits of s 
are both 1. The next two bits are both 0, and the two after that are both 1. 
The bits pair up to be the same, with the pairs alternating between and 1. 
However, the fourth- and third-from-the-last bits form one of these pairs, and 
they are different, giving another contradiction. Therefore, o 2 (s) ^ s for any 
nonzero s for odd j as w ell as for even j. An example for odd j is the [8, 0, 4] 
code shown in table 8.2. 

To show that this set of generators forms the stabilizer for a code, we still 
have to show that they all commute. From the fact that M r and M s commute 
with each other and Mx and Mz, we can immediately conclude that N r and 
N s commute with each other and Mx and Mz- Also, M r and N r commute, 
since they get one sign of —1 for each g x or g z in M r , and there are an even 
number of g x 's and er 2 's. We must show that M r commutes with N s for r =/= s. 
Now, 

n— 1 

JaM) = ]T [z (r) * (s) + er(i) (r V(i) W ] ■ (8.29) 

i=0 

Here, x^) is the rth bit of x. Now, g is a permutation of through n — 1, so 
the second term in the sum is equal to the first term in the sum. Therefore, the 
sum is automatically zero, and these generators do form a stabilizer. 



8.6 CSS Codes 

As discussed in section |3.3| , a CSS code |o) is one where some of the gener- 
ators are tensor products of er^'s and the rest are tensor products of ct z 's. The 
g x generators and the g z generators correspond to the parity check matrices of 
two classical codes C\ and C 2 , with C^ C C 2 . For instance, the classical Reed- 
Muller codes can be used to create a number of good quantum codes. CSS 
codes cannot be as efficient as the most general quantum code, but they can 
still be quite good. We can set upper and lower bounds using adaptations of the 
classical Hamming bound and Gilbert- Varshamov bound. This argument shows 
that the rate k/n of a CSS code to correct t arbitrary errors is asymptotically 
limited by 

1 - 2H{2t/n) <k/n<l- 2H(t/n). (8.30) 
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The CSS codes are a particularly interesting class of codes for two reasons: 
First, they are built using classical codes, which have been more heavily studied 
than quantum codes, so it is fairly easy to construct useful quantum codes 
simply by looking at lists of classical codes. Second, because of the form of the 
generators, the CSS codes are precisely those for which a CNOT applied between 
every pair of corresponding qubits in two blocks performs a valid fault-tolerant 
operation (see section 5.3). This makes them particularly good candidates for 
fault-tolerant computation. 

In order to get universal fault-tolerant computation for a code, the first step 
is to produce the encoded CNOT for the code. For the most general stabilizer 
code, this requires performing a four-qubit operation using two ancilla qubits 
and making two measurements. In a CSS code, this process is reduced to a single 
transversal operation. Next, in order to produce one-qubit operations, we need 
to use one ancilla qubit, perform a CNOT, and make a measurement. For the 
most general CSS code, we will still have to do this. However, if the code has 
the property that C\ = C2 (so C± C C\ ) , then the a x generators have the same 
form as the a z generators, so a transversal Hadamard rotation is also a valid 
fault-tolerant operation. If we further have the property that the parity check 
matrix of C\ has a multiple of four Is in each row, then the transversal phase P 
is a valid fault-tolerant operation too. For a general CSS code satisfying these 
conditions, these operations will perform some multiple-qubit gate on the qubits 
encoded in a single block. However, if each block only encodes a single qubit, we 
can choose the X and Z operators so that transversal Hadamard performs an 
encoded Hadamard rotation, and so that the transversal P performs an encoded 
P or P* . In particular, when C\ is a punctured doubly-even self-dual classical 
code, all these conditions are satisfied, and we can perform any operation in 
N(Q) by performing a single transversal operation |38[ ], In order to get universal 
computation, we will also need the Toffoli gate or some other gate outside N(Q), 
and this will almost always require a more complicated construction. 



8.7 Amplitude Damping Codes 

Suppose we restrict attention to the amplitude damping channel. In this chan- 
nel, each qubit behaves independently according to one of the following matrices: 



1 \ (0 e 



loo 



.31) 



It is difficult to create efficient codes that will deal with the exact evolution 
produced by this channel. However, when e is fairly small, it is sufficient to 



merely satisfy equation (2.1C) approximately [M. If we wish to correct the 
equivalent of one error, corrections of 0(e 3 ) will not matter, since that would 
be equivalent to distinguishing one error from two errors. Let us expand 

vT^) =I 'r 2{I ' <Tz)+ ° {e4) - (8 - 32) 
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Table 8.4: A four-qubit code for the amplitude damping channel. 



All of the higher order corrections to this equation will be powers of I — a z . 
Therefore, if we let 

A = a x (I-a z ) = -(° Q jQ, (8.33) 

and 

B=I-a z , (8.34) 

we need to consider all terms of the form 

(A\E^F\^), (8.35) 

where E and F are products of A and B. We get one factor of e for each A and 
one factor of e 2 for each B. We only need to consider those terms that have 
total order less than e d to have an effectively distance d code. This corrects t 
errors where d = It + 1 . 

One possible way to achieve this is to have a CSS code for which the a z 
generators can correct t a x errors and the <r x generators can detect t a z errors. 



For instance, the code given in table 8.6 will work if we first map a z — > a x and 



Gy — ► a z . For such a code, we are correcting / and a z rather than B. Since B 
is in the linear span of a z and the identity, it is handled by these codes as well. 

We can expand the range of possible codes by taking the actual linear combi- 
nation of / and a z that appears in A and B into account. For instance, consider 



the code from ta ble p.4| J20J . This code can correct one ampl itude damping error 
(i.e., it satisfies ( 2.10 ) to 0(e 3 )). We can instantly see that ( 2.1C| ) is satisfied for 



E^F = Ai (the subscript indicates the affected qubit) or E^F = A\Aj, where 
(i.j) 7^ (1,2), (3, 4). When = (1,2) (or (3,4)), something interesting and 
unusual happens: 

(V^^j) = {i>i\{I- o zl )a xl a x2 {I - a z2 )\^ 3 ) (8.36) 
= (ipi\o x i<7 x2 (I + <J zl ) (I - a z2 )\ipj). (8.37) 

Now, cr zl a z2 \^j) = \ipj), so 

(4'i\o- x ia x2 (I + a z i) {I - (T z2 )\ijjj) = {ipi\o- x ia x2 (I + a zl ) (I - a zl )\ipj) 

(8.38) 

= 0, (8.39) 

since (/ + a z \) (I — a z \) — 0. We also need to consider the terms E^F — B and 
E^F = A\A{ = I — a Z i = B. In this case, we can again separate B into / and 
er z , and the latter is handled by the generator M\. 
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By applying similar principles, we can see that Shor's nine-qubit code (table 
3.1) can be used to correct two amplitude damping errors. We need to consider 
products of one through four A's and products of one or two £?'s, as well as 
the product of a B with one or two A's. Shor's code breaks down into three 
blocks of three. If for any block of three, we have one or two A's acting on that 
block, E^F will anticommute with one of the a z generators for that block, and 
(ipi\E^ F\iPj) = 0. This takes care of all possible operators E^F involving one, 
two, or four A's. We still need to consider AI/I2A3 (and similar terms) and 
products of one or two B's. The products of £Ts we again expand into I and 
<r z , producing products of zero, one, and two cr z 's. Operators with one a z or 
with two cr 2 's in different blocks of three will anticommute with one of the a x 
operators. Operators such as <7 z i<r Z 2 that act on two qubits in the same block 
of three arc in the stabilizer and are thus equivalent to the identity. Finally, 
operators such as AIA2A3 are dealt with similarly to A\A2 for the four qubit 
code above: 

(ipi\A[A^As\^j) = (ipi\(I- cr zl )a xl a x2 {I - a z2 )a x3 (I - tr z3 )|^) (8.40) 

= (lpi\<7xl<rx2<7x3(I + Czl) (I ~ CT z2 ) (I - (T z 3)\lpj) (8.41) 

= l \i>i\ox\Ox20x-i{I + <Jzi) (I - <r z i) (I - <Tx3)\ipj) (8.42) 
= 0. (8.43) 

Thus, the nine qubit code can correct two amplitude damping errors. 

Fault tolerance for these codes must be handled carefully. Transversal oper- 
ations of any sort will not respect the form of the error operators, so we need to 
be sure the code will be able to correct the new error operators. For instance, 
the CNOT applied to I (8 A produces (I ® a x ) (I ® I — a z (8 cr z )- This cannot 
be written as the tensor product of A's and B's. However, J (g) Ai is still distin- 
guishable from the images of I®Aj (since {I®I + a z ®a z ){I®I—a z ®a z ) = 0) 
and Aj ® /. Therefore, transversal CNOT is a valid fault-tolerant operation for 
the four-qubit code as long as we correct errors taking its effects into account. 



8.8 Some Miscellaneous Codes 

In this section I present a few more codes that do not fit easily into any of the 



classes I have already discussed. Figure 8.5 shows an [11,1,5] code, the smallest 



code to correct two errors |26|]. Figure B.6 gives a code that can correct one a x 
error or one o z error, but not a a y error. This code is better than any possible 
distance three code, and is another example illustrating the utility of stabilizer 
codes for more general channels than the depolarizing channel. It is based on the 
classical Hamming code with an additional generator to distinguish between a x 
and a z errors. In fact, this code also detects if a a v error has occurred, although 
it cannot tell us where the error occurred. 

The set of all possible codes includes many codes that are not equivalent to 
stabilizer codes. Currently, however, only one is known that is better than any 
stabilizer code p3| . This code has distance two and encodes six states using five 
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Table 8.5: The stabilizer for an [11,1,5] code. 
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Table 8.6: The stabilizer for a code to correct one o x or o z error. 
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qubits, whereas any distance two stabilizer code could only encode two qubits 
(four states) with five qubits. It can be given in terms of the projection P onto 
the subspace of valid codewords: 

P = 1/16 [3 I g> I g) I g) I g) I + (I g> (T z g) <7 y g) (T y g) CT z ) C yc 

+ (I (g a x ® o z (g a z (g a x ) cyc - (I ® a y ® a x ® a x (g a y ) cyc (8.44) 
+ 2 (ct z (g a x (g <7y (g a y (g a x ) cyc - 2 a z (g a z (g a z (g a z (g a z ] . 

The subscript "eye" means that we actually add the five cyclic permutations of 
the indicated term. Note that this means the projection operator, and there- 
fore the code, is itself cyclic. The trace of P is six, so P projects onto a six- 
dimensional space and the code can therefore be used to encode six basis states. 
Conjugation of P by a Xl a y , or a z on any single qubit will produce P' with 
PP' = 0, so the code for this projection operator satisfies ( 2. 10|) for a distance 
two code, with C a b = S a b- 
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Appendix A 



Quantum Gates 



It is usually helpful to think of a quantum computer as performing a series 
of gates, drawn from some fairly small basic set of physically implementable 
unitary transformations. The net transformation applied to the quantum com- 
puter is the product of the unitary transformations associated with the gates 
performed. In order to have a universal quantum computer, it should be possi- 
ble to get arbitrarily close to any unitary transformation. This property makes 
no guarantees about how many gates are required to get within e of the de- 
sired unitary operation, and figuring out how to get a given operator with the 
minimum number of basic gates is the goal of quantum algorithm design. 

There are a number of known sets of universal quantum gates j(34|, [35| . For 
instance, all single-qubit unitary operators and the controlled-NOT together 
comprise a universal set. The controlled-NOT gate (or CNOT) is a two-qubit 
operator that flips the second qubit iff the first qubit is |1). It has the matrix 

/l 

10 

1 
\0 1 

In fact, the controlled-NOT and one single-qubit operator are sufficient, as long 
as the the single-qubit rotation acts by an angle incommensurate with 2tt. An- 
other finite universal set of quantum gates consists of the Hadamard rotation 
R, 

the phase gate P, 

P = 

the controlled-NOT, and the Toffoli gate, which is a three-qubit gate which flips 
the third qubit iff the first two qubits are in the state |11). 




1 

i 



(A.2) 



(A.3) 



APPENDIX A. QUANTUM GATES 



105 



-©- 



Control- 
Target - 



Controllcd-NOT 



Controlled-c,, 



Controlled- a. 



Control ■ 
Control ■ 
Target ■ 
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Toffoli gate 



P 



{R\- Hadamard R - \t\ - T 



Figure A.l: Various quantum gates. 



In addition to the gates mentioned above, I refer to a number of other simple 
gates in this thesis. For instance, the simple NOT gate, the sign gate, and the 
combined bit and sign flip gate (which are equal to a x , cr 2 , and a v , respectively) 



play a crucial role in the stabilizer formalism, 
qubit gates related to P and R. They are 



I also refer to two other single- 



and 



T=-( 1 



(A.4) 



(A.5) 



I also occasionally refer to the "conditional sign" gate, which is a two-qubit 
gate that gives the basis state 1 11} a sign of —1 and leaves the other three basis 
states alone. The conditional sign gate is equivalent to the controlled-NOT 
via conjugation of one qubit by R. The conditional sign gate is effectively a 
controlled-^ gate, where a z gets applied to one qubit iff the other qubit is |1). 
I also use an analogous controlled-cij, operator. The CNOT is the controlled-cr^. 

To describe a series of gates, it is usually helpful to draw a diagram of the 
gate array. Horizontal lines represent the qubits of the quantum computer, 
which enter at the left and leave from the right. A summary of the symbols I 
use for the various gates is given in figure A.l. 
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Appendix B 



Glossary 



additive code Another name for a stabilizer code. Often contrasted with lin- 
ear quantum codes, which are a subclass of additive codes. 

amplitude damping channel A channel for which the |1) state may relax 
to the |0) state with some probability. An example is a two-level atom 
relaxing via spontaneous emission. 

cat state The n-qubit entangled state |0...0) + |l...l). Cat states act as 
ancillas in many fault-tolerant operations. 

coding space The subset of the Hilbert space corresponding to correctly en- 
coded data. The coding space forms a Hilbert space in its own right. 

concatenation The process of encoding the physical qubits making up one 
code as the logical qubits of a second code. Concatenated codes are par- 
ticularly simple to correct, and can be used to perform arbitrarily long 
fault-tolerant computations as long as the physical error rate is below 
some threshhold. 

CSS code Short for Calderbank-Shor-Steane code. A CSS code is formed from 
two classical error-correcting codes. CSS codes can easily take advantage 
of results from the theory of classical error-correcting codes and are also 



well-suited for fault-tolerant computation. See sections 3.3 and 3.6 



cyclic code A code that is invariant under cyclic permutations of the qubits. 

decoherence The process whereby a quantum system interacts with its envi- 
ronment, which acts to effectively measure the system. The world looks 
classical at large scales because of decoherence. Decoherence is likely to 
be a major cause of errors in quantum computers. 

degenerate code A code for which linearly independent correctable errors act- 
ing on the coding space sometimes produce linearly dependent states. De- 
generate codes bypass many of the known bounds on efficiency of quantum 
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codes and have the potential to be much more efficient than any nondc- 
generate code. 

depolarizing channel A channel that produces a random error on each qubit 
with some fixed probability. 



distance The minimum weight of any operator E^Eb such that equation ( 2.10 ) 
is not satisfied for an orthonormal basis of the coding space. A quantum 
code with distance d can detect up to d — 1 errors, or it can correct 
\_(d — 1)/2J general errors or d — 1 located errors. 

entanglement Nonlocal, nonclassical correlations between two quantum sys- 
tems. The presence of entangled states gives quantum computers their 
additional computational power relative to classical computers. 

entanglement purification protocol Often abbreviated EPP. An EPP is a 

protocol for producing high-quality EPR pairs from a larger number of 
low-quality EPR pairs. EPPs are classified depending on whether they 
use one-way or two-way classical communication. A 1-way EPP (or 1- 
EPP) is equivalent to a quantum error-correcting code. 

EPR pair Short for Einstein-Podalsky- Rosen pair. An EPR pair is the entan- 
gled state (1/V2) (| 00) + |11)), and acts as a basic unit of entanglement. 

erasure channel A channel that produces one or more located errors. 

error syndrome A number classifying the error that has occurred. For a 
stabilizer code, the error syndrome is a binary number with a 1 for each 
generator of the stabilizer the error anticommutes with and a for each 
generator of the stabilizer the error commutes with. 

fault-tolerance The property (possessed by a network of gates) that an error 
on a single physical qubit or gate can only produce one error in any given 
block of an error-correcting code. A fault-tolerant network can be used to 
perform computations that are more resistant to errors than the physical 
qubits and gates composing the computer, provided the error rate is low 
enough to begin with. A valid fault-tolerant operation should also map 
the coding space into itself to avoid producing errors when none existed 
before. 

leakage error An error in which a qubit leaves the allowed computational 
space. By measuring each qubit to see if it is in the computational space, 
a leakage error can be converted into a located error. 

linear code A stabilizer code that, when described in the GF(4) formalism 
(section |3.4[ ), has a stabilizer that is invariant under multiplication by u>. 
Often contrasted with an additive code. 
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located error Sometimes called an erasure. A located error is an error which 
acts on a known qubit in an unknown way. A located error is easier to 
correct than a general error acting on an unknown qubit. 

nice error basis A basis which shares certain essential properties with the 
Pauli matr ices and can be used to define a generalized stabilizer code. See 



section 3.6 



nondegenerate code A code for which linearly independent correctable errors 
acting on the coding space always produce linearly independent states. 
Nondegenerate codes are much easier to set bounds on than degenerate 
codes. 

pasting A construction for combining two quantum codes to make a single 



larger code. See section 3.5 



perfect code A code for which every error syndrome corresponds to a cor- 



rectable error. See section 3.4 for a construction of the distance three 
perfect codes. 

quantum error-correcting code Sometimes abbreviated QECC. A QECC 
is a set of states that can be restored to their original state after some 
number of errors occur. A QECC must satisfy equation ( |2.10 ). 



qubit A single two-state quantum system that serves as the fundamental unit 
of a quantum computer. The word "qubit" comes from "quantum bit." 

qudit A (i-dimensional generalization of a qubit. 

shadow The set of operators in Q which commute with the even-weight ele- 
ments of the stabilizer and anticommute with the odd- weight elements of 
the stabilizer. 

shadow enumerator The weight enumerator of the shadow. It is useful for 
setting bounds on the existence of quantum codes. 

stabilizer The set of tensor products of Pauli matrices that fix every state in 
the coding space. The stabilizer is an Abelian subgroup of the group Q 



defined in section The stabilizer contains all of the vital information 
about a code. In particular, operators in Q that anticommute with some 
element of the stabilizer can be detected by the code. 

stabilizer code A quantum code that can be described by giving its stabilizer. 
Also called an additive code or a GF(4) code. 

teleportation A process whereby a quantum state is destroyed and exactly 
reconstructed elsewhere. Quantum teleportation of a single qubit requires 
one EPR pair shared between the source and destination, and involves two 
measurements on the source qubit. The two bits from the measurements 
must be classically transmitted to the destination in order to reconstruct 
the original quantum state. 
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threshhold The error rate below which a suitably configured quantum com- 
puter can be used to perform arbitrarily long computations. Current 
methods for proving the existence of a threshhold use concatenated codes. 
Most estimates of the threshhold lie in the range 10 -6 - 10~ 4 . 

transversal operation An operation applied in parallel to the various qubits 
in a block of a quantum error-correcting code. Qubits from one block can 
only interact with corresponding qubits from another block or from an 
ancilla. Any transversal operation is automatically fault-tolerant. 

weight A property of operators only defined on operators which can be written 
as the tensor product of single-qubit operators. For such an operator, the 
weight is the number of single-qubit operators in the product that are not 
equal to the identity. 

weight enumerator A polynomial whose coefficients c n are the number of 
elements of weight n in some set, such as the stabilizer or the normalizer 
of the stabilizer. Weight enumerators are very helpful in setting bounds on 
the possible existence of quantum error-correcting codes through identities 



such as the quantum Mac Williams identities (equation (7.14)) 
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